1 #define _LARGEFILE64_SOURCE
5 #include "http_config.h"
7 #include "http_protocol.h"
8 #include "http_request.h"
16 #include <sys/types.h>
20 #error "make sure you include the right stuff here"
24 #define MAXNAMELEN 1024
27 #ifdef STANDARD20_MODULE_STUFF
31 /********************* APACHE1 ******************************************************************************/
33 #include "ap_config.h"
35 #include <sys/ioccom.h>
37 #include <http_conf_globals.h>
39 #define MK_TABLE_GET ap_table_get
40 #define MK_TABLE_SET ap_table_set
41 #define command(name, func, var, type, usage) \
44 RSRC_CONF | ACCESS_CONF , type, usage }
47 /********************* APACHE2 ******************************************************************************/
49 #include <apr_strings.h>
50 #include <apr_base64.h>
51 #define ap_pcalloc apr_pcalloc
52 #define ap_pdupstr apr_pdupstr
53 #define ap_pstrdup apr_pstrdup
54 #define MK_POOL apr_pool_t
55 #define MK_TABLE_GET apr_table_get
56 #define MK_TABLE_SET apr_table_set
58 extern unixd_config_rec unixd_config
;
59 #define ap_user_id unixd_config.user_id
60 #define ap_group_id unixd_config.group_id
61 #define ap_user_name unixd_config.user_name
62 #define command(name, func, var, type, usage) \
63 AP_INIT_ ## type (name, (void*) func, \
65 RSRC_CONF | ACCESS_CONF, usage)
66 module AP_MODULE_DECLARE_DATA waklog_module
;
67 typedef struct { int dummy
; } child_info
;
68 const char *userdata_key
= "waklog_init";
71 /**************************************************************************************************/
75 #include <afs/venus.h>
77 #include <afs/dirpath.h>
78 #include <afs/ptuser.h>
81 #define TKT_LIFE ( 12 * 60 * 60 )
82 #define SLEEP_TIME ( TKT_LIFE - 5*60 )
86 #define WAKLOG_UNSET 0
90 #define APLOG_DEBUG APLOG_ERR
93 /* this is used to turn off pag generation for the backround worker child during startup */
94 int pag_for_children
= 1;
102 int cell_in_principal
;
103 int disable_token_cache
;
106 char *default_principal
;
107 char *default_keytab
;
109 char *afs_cell_realm
;
117 struct ktc_token token
;
118 char clientprincipal
[MAXNAMELEN
];
119 krb5_context kcontext
;
121 struct ktc_principal server
;
122 struct ktc_principal client
;
124 } waklog_child_config
;
126 waklog_child_config child
;
128 struct tokencache_ent
{
129 char clientprincipal
[MAXNAMELEN
];
130 struct ktc_token token
;
131 struct ktc_principal client
;
132 struct ktc_principal server
;
137 #define SHARED_TABLE_SIZE 512
139 struct sharedspace_s
{
141 struct tokencache_ent sharedtokens
[SHARED_TABLE_SIZE
];
144 struct sharedspace_s
*sharedspace
= NULL
;
153 pthread_rwlock_t
*sharedlock
= NULL
;
155 rwlock_t
*sharedlock
= NULL
;
158 struct renew_ent renewtable
[SHARED_TABLE_SIZE
];
164 #define getModConfig(P, X) P = (waklog_config *) ap_get_module_config( (X)->module_config, &waklog_module );
169 #include <sys/ioccom.h>
172 #include <afs/venus.h>
173 #include <afs/auth.h>
174 #include <afs/dirpath.h>
175 #include <afs/ptuser.h>
176 #include <rx/rxkad.h>
180 log_error (const char *file
, int line
, int level
, int status
,
181 const server_rec
* s
, const char *fmt
, ...)
187 vsnprintf (errstr
, 1024, fmt
, ap
);
191 ap_log_error (file
, line
, level
| APLOG_NOERRNO
, status
, s
, "(%d) %s", getpid(), errstr
);
193 ap_log_error (file
, line
, level
| APLOG_NOERRNO
, s
, "(%d) %s", getpid(), errstr
);
198 waklog_config
*retrieve_config(request_rec
*r
) {
203 if ( r
&& r
->main
) {
211 if ( my
&& ( cfg
= (waklog_config
*) ap_get_module_config(my
->per_dir_config
, &waklog_module
) ) ) {
214 getModConfig (cfg
, r
->server
);
221 /* set_auth -- sets the tokens of the current process to this user.
222 if "self" is set, it divines the user from the current requests' environment.
223 otherwise, it's gettng it from principal/keytab */
226 set_auth ( server_rec
*s
, request_rec
*r
, int self
, char *principal
, char *keytab
, int storeonly
) {
230 krb5_error_code kerror
= 0;
231 krb5_principal kprinc
= NULL
;
232 krb5_get_init_creds_opt kopts
;
235 struct ktc_principal server
= { "afs", "", "" };
236 struct ktc_principal client
;
237 struct ktc_token token
;
238 krb5_creds
*v5credsp
= NULL
;
239 krb5_keytab krb5kt
= NULL
;
240 char buf
[MAXNAMELEN
];
244 time_t oldest_time
= 0;
249 int cell_in_principal
;
251 int use_client_credentials
= 0;
253 char k5user
[MAXNAMELEN
];
257 k5path
= !r
? NULL
: MK_TABLE_GET( r
->subprocess_env
, "KRB5CCNAME" );
259 memset((char *) &increds
, 0, sizeof(increds
));
260 /* init some stuff if it ain't already */
262 if ( ! child
.kcontext
) {
263 kerror
= krb5_init_context(&child
.kcontext
);
266 if (!k5path
|| !*k5path
) {
267 k5path
= "MEMORY:tmpcache";
269 if ( ( ! child
.ccache
) && ( kerror
= krb5_cc_resolve(child
.kcontext
, k5path
, &child
.ccache
) ) ) {
270 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: can't initialize credentials cache %s err=%d",
274 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: set_auth: %d, %s, %s, %d, KRB5CC=%s",
275 self
, principal
? principal
: "NULL",
276 keytab
? keytab
: "NULL", storeonly
, k5path
? k5path
: "NULL");
278 /* pull the server config record that we care about... */
281 cfg
= retrieve_config(r
);
283 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
,
284 "mod_waklog: set_auth using no config" );
285 getModConfig (cfg
, s
);
289 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: cfg is %d", cfg
);
294 /* pull out our principal name and stuff from the environment -- webauth better have sent
295 through. This here is also where you'd suck stuff out of KRB5CCNAME if we were
296 using something like Cosign */
298 if ( ! ( r
&& r
->connection
&& r
->user
)) {
299 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: self authentication selected, but no data available");
300 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: r->user=%s", (r
->user
==NULL
? "null" : r
->user
==NULL
));
304 strncpy(k5user
, r
->user
, sizeof(k5user
));
306 /* the other thing we need is someone's password */
307 if ( ! ( k5secret
= (char *) MK_TABLE_GET( r
->notes
, "ATTR_PASSWORD" ) ) ) {
308 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: cant do self auth without a secret");
312 /* we'll pick this up later after we've checked the cache and current state */
316 strncpy(k5user
, r
->user
, sizeof(k5user
));
321 strncpy( k5user
, principal
, sizeof(k5user
));
324 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: set_auth: k5user=%s", k5user
? k5user
: "NULL");
327 /* see if we should just go ahead and ignore this call, since we already should be set to these
333 pthread_rwlock_rdlock( sharedlock
);
335 rw_rdlock( sharedlock
);
338 for ( i
= 0; i
< SHARED_TABLE_SIZE
; ++i
) {
340 /* if it's a token for the principal we're looking for, and it hasn't expired yet */
342 if ( ( !strcmp( k5user
,
343 sharedspace
->sharedtokens
[i
].clientprincipal
) ) &&
344 ( sharedspace
->sharedtokens
[i
].token
.endTime
> mytime
) ) {
346 if ( ! memcmp(&child
.token
, &sharedspace
->sharedtokens
[i
].token
, sizeof(child
.token
) ) ) {
352 /* copy the token out of the cache and into the child object */
354 strcpy(child
.clientprincipal
, sharedspace
->sharedtokens
[i
].clientprincipal
);
355 memcpy(&child
.token
, &sharedspace
->sharedtokens
[i
].token
, sizeof(child
.token
));
356 memcpy(&child
.server
, &sharedspace
->sharedtokens
[i
].server
, sizeof(child
.server
));
357 memcpy(&child
.client
, &sharedspace
->sharedtokens
[i
].client
, sizeof(child
.client
));
359 /* set our last used time thing */
360 sharedspace
->sharedtokens
[i
].lastused
= mytime
;
370 /* release the lock on the token cache */
372 pthread_rwlock_unlock( sharedlock
);
374 rw_unlock( sharedlock
);
378 /* release the lock on the token cache */
379 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
,
380 "mod_waklog: set_auth using shared token %d for %s", i
, k5user
);
384 /* if this is something that was in the cache, and it's the same as the token we already have stored,
385 and we weren't calling this just to renew it... */
387 if ( usecached
&& indentical
) {
388 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: token is identical for %s", k5user
);
394 /* if 'usecached' isn't set, we've got to get our tokens from somewhere... */
395 if (( ! usecached
) && ( k5user
)) {
397 /* clear out the creds structure */
398 memset((void *) &v5creds
, 0, sizeof(v5creds
));
400 /* create a principal out of our k5user string */
402 if ( kerror
= krb5_parse_name (child
.kcontext
, k5user
, &kprinc
) ) {
403 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_parse_name %s", (char *) error_message(kerror
) );
407 /* create the credentials options */
409 krb5_get_init_creds_opt_init ( &kopts
);
410 krb5_get_init_creds_opt_set_tkt_life ( &kopts
, TKT_LIFE
);
411 krb5_get_init_creds_opt_set_renew_life ( &kopts
, 0 );
412 krb5_get_init_creds_opt_set_forwardable ( &kopts
, 0 );
413 krb5_get_init_creds_opt_set_proxiable ( &kopts
, 0 );
417 /* if we've been passed a keytab, we're going to be getting our credentials from it */
419 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: using keytab %s", keytab
);
421 if ( kerror
= krb5_kt_resolve(child
.kcontext
, keytab
, &krb5kt
) ) {
422 log_error( APLOG_MARK
, APLOG_ERR
, 0, s
,
423 "mod_waklog: krb5_kt_resolve %s", error_message(kerror
) );
427 if ((kerror
= krb5_get_init_creds_keytab (child
.kcontext
, &v5creds
,
428 kprinc
, krb5kt
, 0, NULL
, &kopts
) ) ) {
429 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_get_init_creds_keytab %s",
430 error_message(kerror
) );
436 /* if 'self' is set, we're going to use the credentials provided in the credential information */
437 /* if you're using CoSign, you'd actually just set the ccache to the KRB5CCNAME credentials */
438 /* and skip ahead... Our WebSSO is lame, but has a way for us to snarf the password out of */
439 /* the encrypted token for proxy-authentication stuff. We only hand out keys that allow this */
440 /* functionality to VERY special people. */
442 if ((kerror
= krb5_get_init_creds_password ( child
.kcontext
, &v5creds
,
443 kprinc
, k5secret
, NULL
, NULL
, 0, NULL
, &kopts
) ) ) {
444 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_get_init_creds_password %s",
445 error_message(kerror
) );
446 /* nuke the password so it doesn't end up in core files */
447 memset(k5secret
, 0, sizeof(k5secret
));
451 memset(k5secret
, 0, sizeof(k5secret
));
454 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: no keytab, no self; assuming mod_auth_kerb or similar");
455 use_client_credentials
= 1;
458 /* initialize the credentials cache and store the stuff we just got */
459 if (!use_client_credentials
) {
460 if ( kerror
= krb5_cc_initialize (child
.kcontext
, child
.ccache
, kprinc
)) {
461 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: init credentials cache %s",
462 error_message(kerror
));
466 if ( kerror
= krb5_cc_store_cred(child
.kcontext
, child
.ccache
, &v5creds
) ) {
467 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: cannot store credentials %s",
468 error_message(kerror
));
473 krb5_free_cred_contents(child
.kcontext
, &v5creds
);
476 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: store cred %s", error_message(kerror
));
480 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: kinit ok for %s", k5user
);
482 /* now, to the 'aklog' portion of our program. */
484 /** we make two attempts here, one for afs@REALM and one for afs/cell@REALM */
485 for(attempt
= 0; attempt
<= 1; attempt
++) {
486 strncpy( buf
, "afs", sizeof(buf
) - 1 );
487 cell_in_principal
= (cfg
->cell_in_principal
+ attempt
) % 2;
489 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: cell_in_principal=%d", cell_in_principal
);
490 if (cell_in_principal
) {
491 strncat(buf
, "/", sizeof(buf
) - strlen(buf
) - 1);
492 strncat(buf
, cfg
->afs_cell
, sizeof(buf
) - strlen(buf
) - 1);
494 if (cfg
->afs_cell_realm
!= WAKLOG_UNSET
) {
495 strncat(buf
, "@", sizeof(buf
) - strlen(buf
) - 1);
496 strncat(buf
, cfg
->afs_cell_realm
, sizeof(buf
) - strlen(buf
) - 1);
499 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: using AFS principal: %s", buf
);
501 if ((kerror
= krb5_parse_name (child
.kcontext
, buf
, &increds
.server
))) {
502 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_parse name %s", error_message(kerror
));
506 if (use_client_credentials
) {
507 if (( kerror
= krb5_cc_resolve( child
.kcontext
, k5path
, &child
.ccache
)) != 0 ) {
508 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_cc_resolve %s", error_message(kerror
));
513 if ((kerror
= krb5_cc_get_principal(child
.kcontext
, child
.ccache
, &increds
.client
))) {
514 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_cc_get_princ %s", error_message(kerror
));
518 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: retrieved data from ccache for %s", k5user
);
520 increds
.times
.endtime
= 0;
522 increds
.keyblock
.enctype
= ENCTYPE_DES_CBC_CRC
;
524 if (kerror
= krb5_get_credentials (child
.kcontext
, 0, child
.ccache
, &increds
, &v5credsp
)) {
525 /* only complain once we've tried both afs@REALM and afs/cell@REALM */
527 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: krb5_get_credentials: %s",
528 error_message(kerror
));
534 cfg
->cell_in_principal
= cell_in_principal
;
538 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: get_credentials passed for %s", k5user
);
540 if ( v5credsp
->ticket
.length
>= MAXKTCTICKETLEN
) {
541 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: ticket size (%d) too big to fake",
542 v5credsp
->ticket
.length
);
546 memset(&token
, 0, sizeof(struct ktc_token
));
548 token
.startTime
= v5credsp
->times
.starttime
? v5credsp
->times
.starttime
: v5credsp
->times
.authtime
;
549 token
.endTime
= v5credsp
->times
.endtime
;
551 memmove( &token
.sessionKey
, v5credsp
->keyblock
.contents
, v5credsp
->keyblock
.length
);
552 token
.kvno
= RXKAD_TKT_TYPE_KERBEROS_V5
;
553 token
.ticketLen
= v5credsp
->ticket
.length
;
554 memmove( token
.ticket
, v5credsp
->ticket
.data
, token
.ticketLen
);
558 memmove( buf
, v5credsp
->client
->data
[0].data
, min(v5credsp
->client
->data
[0].length
,
560 buf
[v5credsp
->client
->data
[0].length
] = '\0';
561 if ( v5credsp
->client
->length
> 1 ) {
562 strncat(buf
, ".", sizeof(buf
) - strlen(buf
) - 1);
563 buflen
= strlen(buf
);
564 memmove(buf
+ buflen
, v5credsp
->client
->data
[1].data
,
565 min(v5credsp
->client
->data
[1].length
,
566 MAXKTCNAMELEN
- strlen(buf
) - 1));
567 buf
[buflen
+ v5credsp
->client
->data
[1].length
] = '\0';
570 /* assemble the client */
571 strncpy(client
.name
, buf
, sizeof(client
.name
) - 1 );
572 strncpy(client
.instance
, "", sizeof(client
.instance
) - 1 );
573 memmove(buf
, v5credsp
->client
->realm
.data
, min(v5credsp
->client
->realm
.length
,
575 buf
[v5credsp
->client
->realm
.length
] = '\0';
576 strncpy(client
.cell
, buf
, sizeof(client
.cell
));
578 /* assemble the server's cell */
579 strncpy(server
.cell
, cfg
->afs_cell
, sizeof(server
.cell
) - 1);
581 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: preparing to init PTS connection for %s", server
.cell
);
583 /* fill out the AFS ID in the client name */
584 /* we've done a pr_Initialize in the child_init -- once, per process. If you try to do it more
585 * strange things seem to happen. */
588 afs_int32 viceId
= 0;
590 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: making PTS call to look up %s", client
.name
);
592 if ( ( rc
= pr_SNameToId( client
.name
, &viceId
) ) == 0 ) {
593 snprintf( client
.name
, sizeof(client
.name
), "AFS ID %d", viceId
);
595 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: PTS call returned error %d ", rc
);
598 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: PTS call returned %s ", client
.name
);
602 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: server: name %s, instance %s, cell %s",
603 server
.name
, server
.instance
, server
.cell
);
605 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: client: name %s, instance %s, cell %s",
606 client
.name
, client
.instance
, client
.cell
);
608 /* copy the resulting stuff into the child structure */
610 strncpy(child
.clientprincipal
, k5user
, sizeof(child
.clientprincipal
));
611 memcpy(&child
.token
, &token
, sizeof(child
.token
));
612 memcpy(&child
.server
, &server
, sizeof(child
.server
));
613 memcpy(&child
.client
, &client
, sizeof(child
.client
));
615 /* stuff the resulting token-related stuff into our shared token cache */
616 /* note, that anything that was set from a keytab is "persistant", and is immune
617 * from LRU-aging. This is because nothing but the process that's running as root
618 * can update these, and it's running every hour or so and renewing these tokens.
619 * and we don't want them aged out.
622 mytime
= oldest_time
= time(0);
624 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: waiting for shared space for %s ", k5user
);
627 pthread_rwlock_wrlock(sharedlock
);
629 rw_wrlock(sharedlock
);
632 for( i
= ( SHARED_TABLE_SIZE
- 1 ); i
>= 0; i
-- ) {
633 if ( ( sharedspace
->sharedtokens
[i
].lastused
<= oldest_time
) &&
634 ( sharedspace
->sharedtokens
[i
].persist
== 0 ) ) {
636 oldest_time
= sharedspace
->sharedtokens
[i
].lastused
;
638 if ( ! strcmp ( sharedspace
->sharedtokens
[i
].clientprincipal
,
639 child
.clientprincipal
) ) {
640 memcpy(&sharedspace
->sharedtokens
[i
].token
, &child
.token
, sizeof(child
.token
) );
641 memcpy(&sharedspace
->sharedtokens
[i
].client
, &child
.client
, sizeof(child
.client
) );
642 memcpy(&sharedspace
->sharedtokens
[i
].server
, &child
.server
, sizeof(child
.server
) );
643 sharedspace
->sharedtokens
[i
].lastused
= mytime
;
644 sharedspace
->sharedtokens
[i
].persist
= keytab
? 1 : 0;
650 if ( stored
== -1 ) {
651 memcpy(&sharedspace
->sharedtokens
[oldest
].token
, &child
.token
, sizeof(child
.token
) );
652 memcpy(&sharedspace
->sharedtokens
[oldest
].client
, &child
.client
, sizeof(child
.client
) );
653 memcpy(&sharedspace
->sharedtokens
[oldest
].server
, &child
.server
, sizeof(child
.server
) );
654 strcpy(sharedspace
->sharedtokens
[oldest
].clientprincipal
, child
.clientprincipal
);
655 sharedspace
->sharedtokens
[oldest
].lastused
= mytime
;
656 sharedspace
->sharedtokens
[oldest
].persist
= keytab
? 1 : 0;
661 pthread_rwlock_unlock(sharedlock
);
663 rw_unlock(sharedlock
);
666 log_error( APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: token stored in slot %d for %s", stored
,
667 child
.clientprincipal
);
669 } else if ( ! usecached
) {
670 log_error( APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: set_auth divergent case");
679 /* don't ask. Something about AIX. We're leaving it here.*/
680 /* write(2, "", 0); */
682 /* we try twice, because sometimes the first one fails. Dunno why, but it always works the second time */
684 if ((rc
= ktc_SetToken(&child
.server
, &child
.token
, &child
.client
, 0))) {
685 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: settoken returned %s for %s -- trying again",
686 error_message(rc
), k5user
);
687 if ((rc
= ktc_SetToken(&child
.server
, &child
.token
, &child
.client
, 0))) {
688 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: settoken2 returned %s for %s",
689 error_message(rc
), k5user
);
696 krb5_free_cred_contents(child
.kcontext
, v5credsp
);
697 if ( increds
.client
)
698 krb5_free_principal (child
.kcontext
, increds
.client
);
699 if ( increds
.server
)
700 krb5_free_principal (child
.kcontext
, increds
.server
);
702 (void) krb5_kt_close(child
.kcontext
, krb5kt
);
704 krb5_free_principal (child
.kcontext
, kprinc
);
707 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: set_auth ending with %d", rc
);
708 } else if ( kerror
) {
709 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: set_auth ending with krb5 error %d, %s", kerror
, error_message(kerror
));
711 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: set_auth ending ok");
714 return kerror
? (int) kerror
: (int) rc
;
721 waklog_create_server_config (MK_POOL
* p
, server_rec
* s
)
725 cfg
= (waklog_config
*) ap_pcalloc (p
, sizeof (waklog_config
));
727 memset(cfg
, 0, sizeof(waklog_config
));
728 cfg
->path
= "(server)";
729 cfg
->protect
= WAKLOG_UNSET
;
730 cfg
->usertokens
= WAKLOG_UNSET
;
731 cfg
->disable_token_cache
= WAKLOG_UNSET
;
732 cfg
->keytab
= WAKLOG_UNSET
;
733 cfg
->principal
= WAKLOG_UNSET
;
734 cfg
->default_principal
= WAKLOG_UNSET
;
735 cfg
->default_keytab
= WAKLOG_UNSET
;
736 cfg
->afs_cell
= WAKLOG_UNSET
;
737 cfg
->afs_cell_realm
= WAKLOG_UNSET
;
741 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
,
742 "mod_waklog: server config created.");
747 /* initialize with host-config information */
750 waklog_create_dir_config (MK_POOL
* p
, char *dir
)
754 cfg
= (waklog_config
*) ap_pcalloc (p
, sizeof (waklog_config
));
755 memset(cfg
, 0, sizeof(waklog_config
));
757 cfg
->path
= ap_pstrdup(p
, dir
);
758 cfg
->protect
= WAKLOG_UNSET
;
759 cfg
->usertokens
= WAKLOG_UNSET
;
760 cfg
->disable_token_cache
= WAKLOG_UNSET
;
761 cfg
->keytab
= WAKLOG_UNSET
;
762 cfg
->principal
= WAKLOG_UNSET
;
763 cfg
->default_principal
= WAKLOG_UNSET
;
764 cfg
->default_keytab
= WAKLOG_UNSET
;
765 cfg
->afs_cell
= WAKLOG_UNSET
;
766 cfg
->afs_cell_realm
= WAKLOG_UNSET
;
773 static void *waklog_merge_dir_config(MK_POOL
*p
, void *parent_conf
, void *newloc_conf
) {
775 waklog_config
*merged
= ( waklog_config
* ) ap_pcalloc(p
, sizeof(waklog_config
) );
776 waklog_config
*parent
= ( waklog_config
* ) parent_conf
;
777 waklog_config
*child
= ( waklog_config
* ) newloc_conf
;
779 merged
->protect
= child
->protect
!= WAKLOG_UNSET
? child
->protect
: parent
->protect
;
781 merged
->path
= child
->path
!= WAKLOG_UNSET
? child
->path
: parent
->path
;
783 merged
->usertokens
= child
->usertokens
!= WAKLOG_UNSET
? child
->usertokens
: parent
->usertokens
;
785 merged
->disable_token_cache
= child
->disable_token_cache
!= WAKLOG_UNSET
? child
->disable_token_cache
: parent
->disable_token_cache
;
787 merged
->principal
= child
->principal
!= WAKLOG_UNSET
? child
->principal
: parent
->principal
;
789 merged
->keytab
= child
->keytab
!= WAKLOG_UNSET
? child
->keytab
: parent
->keytab
;
791 merged
->default_keytab
= child
->default_keytab
!= WAKLOG_UNSET
? child
->default_keytab
: parent
->default_keytab
;
793 merged
->default_principal
= child
->default_principal
!= WAKLOG_UNSET
? child
->default_principal
: parent
->default_principal
;
795 merged
->afs_cell
= child
->afs_cell
!= WAKLOG_UNSET
? child
->afs_cell
: parent
->afs_cell
;
797 merged
->afs_cell_realm
= child
->afs_cell_realm
!= WAKLOG_UNSET
? child
->afs_cell_realm
: parent
->afs_cell_realm
;
799 return (void *) merged
;
803 static void *waklog_merge_server_config(MK_POOL
*p
, void *parent_conf
, void *newloc_conf
) {
805 waklog_config
*merged
= ( waklog_config
* ) ap_pcalloc(p
, sizeof(waklog_config
) );
806 waklog_config
*pconf
= ( waklog_config
* ) parent_conf
;
807 waklog_config
*nconf
= ( waklog_config
* ) newloc_conf
;
809 merged
->protect
= nconf
->protect
== WAKLOG_UNSET
? pconf
->protect
: nconf
->protect
;
811 merged
->usertokens
= nconf
->usertokens
== WAKLOG_UNSET
? pconf
->usertokens
: nconf
->usertokens
;
813 merged
->disable_token_cache
= nconf
->disable_token_cache
== WAKLOG_UNSET
? pconf
->disable_token_cache
: nconf
->disable_token_cache
;
815 merged
->keytab
= nconf
->keytab
== WAKLOG_UNSET
? ap_pstrdup(p
, pconf
->keytab
) :
816 ( nconf
->keytab
== WAKLOG_UNSET
? WAKLOG_UNSET
: ap_pstrdup(p
, pconf
->keytab
) );
818 merged
->principal
= nconf
->principal
== WAKLOG_UNSET
? ap_pstrdup(p
, pconf
->principal
) :
819 ( nconf
->principal
== WAKLOG_UNSET
? WAKLOG_UNSET
: ap_pstrdup(p
, pconf
->principal
) );
821 merged
->afs_cell
= nconf
->afs_cell
== WAKLOG_UNSET
? ap_pstrdup(p
, pconf
->afs_cell
) :
822 ( nconf
->afs_cell
== WAKLOG_UNSET
? WAKLOG_UNSET
: ap_pstrdup(p
, pconf
->afs_cell
) );
824 merged
->afs_cell_realm
= nconf
->afs_cell_realm
== WAKLOG_UNSET
? ap_pstrdup(p
, pconf
->afs_cell_realm
) :
825 ( nconf
->afs_cell_realm
== WAKLOG_UNSET
? WAKLOG_UNSET
: ap_pstrdup(p
, pconf
->afs_cell_realm
) );
827 merged
->default_keytab
= nconf
->default_keytab
== WAKLOG_UNSET
? ap_pstrdup(p
, pconf
->default_keytab
) :
828 ( nconf
->default_keytab
== WAKLOG_UNSET
? WAKLOG_UNSET
: ap_pstrdup(p
, pconf
->default_keytab
) );
830 merged
->default_principal
= nconf
->default_principal
== WAKLOG_UNSET
? ap_pstrdup(p
, pconf
->default_principal
) :
831 ( nconf
->default_principal
== WAKLOG_UNSET
? WAKLOG_UNSET
: ap_pstrdup(p
, pconf
->default_principal
) );
834 return (void *) merged
;
839 set_waklog_enabled (cmd_parms
* params
, void *mconfig
, int flag
)
841 waklog_config
*cfg
= mconfig
? ( waklog_config
* ) mconfig
:
842 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
846 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, params
->server
,
847 "mod_waklog: waklog_enabled set on %s", cfg
->path
? cfg
->path
: "NULL");
852 /* this adds a principal/keytab pair to get their tokens renewed by the
853 child process every few centons. */
855 void add_to_renewtable(MK_POOL
*p
, char *keytab
, char *principal
) {
859 if ( renewcount
>= SHARED_TABLE_SIZE
) {
860 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, NULL
, "mod_waklog: big problem. Increase the SHARED_TABLE_SIZE or \
861 decrease your tokens.");
865 /* check to see if it's already there */
867 for ( i
= 0; i
< renewcount
; i
++ ) {
868 if ( ! strcmp(renewtable
[i
].principal
, principal
) ) {
873 renewtable
[renewcount
].keytab
= ap_pstrdup(p
, keytab
);
874 renewtable
[renewcount
].principal
= ap_pstrdup(p
, principal
);
875 renewtable
[renewcount
].lastrenewed
= 0;
881 set_waklog_location_principal (cmd_parms
*params
, void *mconfig
, char *principal
, char *keytab
)
883 waklog_config
*cfg
= mconfig
? ( waklog_config
* ) mconfig
:
884 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
886 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, params
->server
,
887 "mod_waklog: configuring principal: %s, keytab: %s", principal
, keytab
);
889 cfg
->principal
= ap_pstrdup(params
->pool
, principal
);
890 cfg
->keytab
= ap_pstrdup (params
->pool
, keytab
);
892 add_to_renewtable(params
->pool
, keytab
, principal
);
900 set_waklog_afs_cell (cmd_parms
* params
, void *mconfig
, char *file
)
902 waklog_config
*waklog_mconfig
= ( waklog_config
* ) mconfig
;
903 waklog_config
*waklog_srvconfig
=
904 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
906 log_error (APLOG_MARK
, APLOG_INFO
, 0, params
->server
,
907 "mod_waklog: will use afs_cell: %s", file
);
909 waklog_srvconfig
->cell_in_principal
= 0;
910 waklog_srvconfig
->afs_cell
= ap_pstrdup (params
->pool
, file
);
911 waklog_srvconfig
->configured
= 1;
913 if (waklog_mconfig
!= NULL
) {
914 waklog_mconfig
->cell_in_principal
= waklog_srvconfig
->cell_in_principal
;
915 waklog_mconfig
->afs_cell
= ap_pstrdup (params
->pool
, file
);
916 waklog_mconfig
->configured
= 1;
922 set_waklog_afs_cell_realm (cmd_parms
* params
, void *mconfig
, char *file
)
924 waklog_config
*waklog_mconfig
= ( waklog_config
* ) mconfig
;
925 waklog_config
*waklog_srvconfig
=
926 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
928 log_error (APLOG_MARK
, APLOG_INFO
, 0, params
->server
,
929 "mod_waklog: will use afs_cell_realm: %s", file
);
931 waklog_srvconfig
->afs_cell_realm
= ap_pstrdup (params
->pool
, file
);
933 if (waklog_mconfig
!= NULL
) {
934 waklog_mconfig
->afs_cell_realm
= ap_pstrdup (params
->pool
, file
);
940 set_waklog_default_principal (cmd_parms
* params
, void *mconfig
, char *principal
, char *keytab
)
942 waklog_config
*cfg
= mconfig
? ( waklog_config
* ) mconfig
:
943 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
945 waklog_config
*srvcfg
= ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
947 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, params
->server
,
948 "mod_waklog: set default princ/keytab: %s, %s for %s", principal
, keytab
, cfg
->path
? cfg
->path
: "NULL");
950 cfg
->default_principal
= ap_pstrdup (params
->pool
, principal
);
951 cfg
->default_keytab
= ap_pstrdup(params
->pool
, keytab
);
953 /* this also gets set at the server level */
954 if ( mconfig
&& ( ! cfg
->path
) ) {
955 srvcfg
->default_principal
= ap_pstrdup (params
->pool
, principal
);
956 srvcfg
->default_keytab
= ap_pstrdup(params
->pool
, keytab
);
958 log_error(APLOG_MARK
, APLOG_ERR
, 0, params
->server
, "only able to set default principal on a global level!");
959 return "Unable to set DefaultPrincipal outside of top level config!";
962 add_to_renewtable( params
->pool
, keytab
, principal
);
970 set_waklog_use_usertokens (cmd_parms
* params
, void *mconfig
, int flag
)
972 waklog_config
*cfg
= mconfig
? ( waklog_config
* ) mconfig
:
973 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
975 cfg
->usertokens
= flag
;
979 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, params
->server
,
980 "mod_waklog: waklog_use_user_tokens set");
986 set_waklog_disable_token_cache (cmd_parms
* params
, void *mconfig
, int flag
)
988 waklog_config
*cfg
= mconfig
? ( waklog_config
* ) mconfig
:
989 ( waklog_config
* ) ap_get_module_config(params
->server
->module_config
, &waklog_module
);
991 cfg
->disable_token_cache
= flag
;
995 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, params
->server
,
996 "mod_waklog: waklog_disable_token_cache set");
1002 static void waklog_child_exit( server_rec
*s
, MK_POOL
*p
) {
1004 apr_status_t
waklog_child_exit( void *sr
) {
1006 server_rec
*s
= (server_rec
*) sr
;
1009 if ( child
.ccache
) {
1010 krb5_cc_close(child
.kcontext
, child
.ccache
);
1013 if ( child
.kcontext
) {
1014 krb5_free_context(child
.kcontext
);
1017 /* forget our tokens */
1019 ktc_ForgetAllTokens ();
1021 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
,
1022 "mod_waklog: waklog_child_exit complete");
1032 waklog_child_init (MK_POOL
* p
, server_rec
* s
)
1034 waklog_child_init (server_rec
* s
, MK_POOL
* p
)
1038 krb5_error_code code
;
1043 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: child_init called for pid %d", getpid());
1045 if ( !sharedspace
) {
1046 log_error( APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: child_init called without shared space? %d", getpid());
1050 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: child_init called for pid %d", getpid());
1052 memset (&child
, 0, sizeof(child
));
1054 if ( code
= krb5_init_context(&child
.kcontext
) ) {
1055 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: can't init kerberos context %d", code
);
1058 if ( code
= krb5_cc_resolve(child
.kcontext
, "MEMORY:tmpcache", &child
.ccache
) ) {
1059 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: can't initialize in-memory credentials cache %d", code
);
1062 if ( pag_for_children
) {
1066 getModConfig (cfg
, s
);
1068 if ( cfg
->default_principal
!= WAKLOG_UNSET
) {
1069 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: child_init setting default user %s, %s", cfg
->default_principal
, cfg
->default_keytab
);
1070 set_auth( s
, NULL
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1073 cell
= strdup(cfg
->afs_cell
);
1074 pr_Initialize( 0, AFSDIR_CLIENT_ETC_DIR
, cell
);
1077 apr_pool_cleanup_register(p
, s
, waklog_child_exit
, apr_pool_cleanup_null
);
1080 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
,
1081 "mod_waklog: child_init returned");
1086 command_rec waklog_cmds
[] = {
1088 command ("WaklogAFSCell", set_waklog_afs_cell
, 0, TAKE1
,
1089 "Use the supplied AFS cell (required)"),
1091 command ("WaklogAFSCellRealm", set_waklog_afs_cell_realm
, 0, TAKE1
,
1092 "Assume that the AFS cell belongs to the specified Kerberos realm (optional)"),
1094 command ("WaklogEnabled", set_waklog_enabled
, 0, FLAG
,
1095 "enable waklog on a server, location, or directory basis"),
1097 command ("WaklogDefaultPrincipal", set_waklog_default_principal
, 0, TAKE2
,
1098 "Set the default principal that the server runs as"),
1100 command ("WaklogLocationPrincipal", set_waklog_location_principal
, 0, TAKE2
,
1101 "Set the principal on a <Location>-specific basis"),
1103 command ("WaklogDisableTokenCache", set_waklog_disable_token_cache
, 0, FLAG
,
1104 "Ignore the token cache (location-specific); useful for scripts that need kerberos tickets."),
1106 command ("WaklogUseUserTokens", set_waklog_use_usertokens
, 0, FLAG
,
1107 "Use the requesting user tokens (from webauth)"),
1113 /* not currently using this */
1116 token_cleanup (void *data
)
1118 request_rec
*r
= (request_rec
*) data
;
1120 if (child
.token
.ticketLen
)
1122 memset (&child
.token
, 0, sizeof (struct ktc_token
));
1124 ktc_ForgetAllTokens ();
1126 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1127 "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d",
1134 waklog_child_routine (void *data
, child_info
* pinfo
)
1137 server_rec
*s
= (server_rec
*) data
;
1138 krb5_error_code code
;
1140 time_t sleep_time
= ( TKT_LIFE
/ 2 ) ;
1145 getModConfig( cfg
, s
);
1147 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: waklog_child_routine started, running as %d", getuid());
1149 memset (&child
, 0, sizeof(child
));
1151 if ( code
= krb5_init_context(&child
.kcontext
) ) {
1152 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: can't init kerberos context %d", code
);
1155 if ( code
= krb5_cc_resolve(child
.kcontext
, "MEMORY:tmpcache", &child
.ccache
) ) {
1156 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: can't initialize in-memory credentials cache %d", code
);
1159 /* need to do this so we can make PTS calls */
1160 cell
= strdup(cfg
->afs_cell
); /* stupid */
1161 pr_Initialize( 0, AFSDIR_CLIENT_ETC_DIR
, cell
);
1165 for ( i
= 0; i
< renewcount
; ++i
) {
1166 renewtable
[i
].lastrenewed
= time(0);
1167 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: (pid %d) renewing %s / %s", getpid(), renewtable
[i
].principal
,
1168 renewtable
[i
].keytab
);
1170 set_auth( s
, NULL
, 0, renewtable
[i
].principal
, renewtable
[i
].keytab
, 1 );
1172 /* if this is our default token, we want to "stash" it in our current PAG so the parent maintains readability of
1173 things that it needs to read */
1175 if ( cfg
&& cfg
->default_principal
&& ( ! strcmp(cfg
->default_principal
, renewtable
[i
].principal
) ) ) {
1176 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: renewing/setting default tokens" );
1177 set_auth( s
, NULL
, 0, renewtable
[i
].principal
, renewtable
[i
].keytab
, 0 );
1182 sharedspace
->renewcount
++;
1191 left
-= ( time(0) - when
);
1202 waklog_init_handler (apr_pool_t
* p
, apr_pool_t
* plog
,
1203 apr_pool_t
* ptemp
, server_rec
* s
)
1206 extern char *version
;
1211 int use_existing
= 1;
1213 char cache_file
[MAXNAMELEN
];
1215 pthread_rwlockattr_t rwlock_attr
;
1219 getModConfig (cfg
, s
);
1221 /* initialize_module() will be called twice, and if it's a DSO
1222 * then all static data from the first call will be lost. Only
1223 * set up our static data on the second call.
1224 * see http://issues.apache.org/bugzilla/show_bug.cgi?id=37519 */
1225 apr_pool_userdata_get (&data
, userdata_key
, s
->process
->pool
);
1228 if (cfg
->afs_cell
==NULL
) {
1229 log_error (APLOG_MARK
, APLOG_ERR
, 0, s
,
1230 "mod_waklog: afs_cell==NULL; please provide the WaklogAFSCell directive");
1231 /** clobber apache */
1237 apr_pool_userdata_set ((const void *) 1, userdata_key
,
1238 apr_pool_cleanup_null
, s
->process
->pool
);
1242 log_error (APLOG_MARK
, APLOG_INFO
, 0, s
,
1243 "mod_waklog: version %s initialized for cell %s", version
, cfg
->afs_cell
);
1245 if ( sharedspace
) {
1246 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: shared memory already allocated." );
1249 snprintf( cache_file
, MAXNAMELEN
, "/tmp/waklog_cache.%d", getpid() );
1251 if ( ( fd
= open( cache_file
, O_RDWR
, 0600 ) ) == -1 ) {
1253 if ( errno
== ENOENT
) {
1255 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: creating shared token cache file %s", cache_file
);
1257 if ( ( fd
= open( cache_file
, O_RDWR
|O_CREAT
|O_TRUNC
, 0600 ) ) == -1 ) {
1258 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: cannot create shared token cache file %s (%d)", cache_file
, errno
);
1262 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: cannot open existing shared token cache file %s (%d)", cache_file
, errno
);
1266 if ( use_existing
== 0 ) {
1267 struct sharedspace_s bob
;
1268 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: sizing our cache file %d to %d", fd
, sizeof(struct sharedspace_s
) );
1269 memset( &bob
, 0, sizeof(struct sharedspace_s
));
1270 write(fd
, &bob
, sizeof(struct sharedspace_s
));
1271 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: done sizing our cache file to %d", sizeof(struct sharedspace_s
) );
1274 /* mmap the region */
1276 if ( ( sharedspace
= (struct sharedspace_s
*) mmap ( NULL
, sizeof(struct sharedspace_s
), PROT_READ
|PROT_WRITE
, MAP_SHARED
, fd
, 0 ) ) != MAP_FAILED
) {
1277 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: shared mmap region ok %d", sharedspace
);
1280 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: mmap failed %d", errno
);
1286 #define locktype pthread_rwlock_t
1288 #define locktype rwlock_t
1291 if ( sharedlock
= ( locktype
* ) mmap ( NULL
, sizeof(locktype
), PROT_READ
|PROT_WRITE
, MAP_SHARED
|MAP_ANON
, -1, 0 ) ) {
1292 #ifndef use_pthreads
1293 rwlock_init(sharedlock
, USYNC_PROCESS
, NULL
);
1295 pthread_rwlockattr_init(&rwlock_attr
);
1296 pthread_rwlockattr_setpshared(&rwlock_attr
, PTHREAD_PROCESS_SHARED
);
1297 pthread_rwlock_init(sharedlock
, &rwlock_attr
);
1300 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: rwlock mmap failed %d", errno
);
1305 /* set our default tokens */
1307 oldrenewcount
= sharedspace
->renewcount
;
1309 pag_for_children
= 0;
1311 proc
= (apr_proc_t
*) ap_pcalloc (s
->process
->pool
, sizeof (apr_proc_t
));
1313 rv
= apr_proc_fork (proc
, s
->process
->pool
);
1315 if (rv
== APR_INCHILD
)
1317 waklog_child_routine (s
, NULL
);
1321 apr_pool_note_subprocess (s
->process
->pool
, proc
, APR_KILL_ALWAYS
);
1323 /* parent and child */
1324 cfg
->forked
= proc
->pid
;
1325 pag_for_children
= 1;
1327 if ( use_existing
== 0 ) {
1328 /* wait here until our child process has gone and done it's renewing thing. */
1329 while( sharedspace
->renewcount
== oldrenewcount
) {
1330 log_error( APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: waiting for tokens..." );
1335 if ( cfg
->default_principal
) {
1336 set_auth( s
, NULL
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1343 waklog_init (server_rec
* s
, MK_POOL
* p
)
1345 extern char *version
;
1350 int use_existing
= 1;
1352 char cache_file
[MAXNAMELEN
];
1354 pthread_rwlockattr_t rwlock_attr
;
1357 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
,
1358 "mod_waklog: version %s initialized.", version
);
1360 if ( sharedspace
) {
1361 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: shared memory already allocated." );
1364 snprintf( cache_file
, MAXNAMELEN
, "/tmp/waklog_cache.%d", getpid() );
1366 if ( ( fd
= open( cache_file
, O_RDWR
, 0600 ) ) == -1 ) {
1368 if ( errno
== ENOENT
) {
1370 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: creating shared token cache file %s", cache_file
);
1372 if ( ( fd
= open( cache_file
, O_RDWR
|O_CREAT
|O_TRUNC
, 0600 ) ) == -1 ) {
1373 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: cannot create shared token cache file %s (%d)", cache_file
, errno
);
1377 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: cannot open existing shared token cache file %s (%d)", cache_file
, errno
);
1382 if ( use_existing
== 0 ) {
1383 struct sharedspace_s bob
;
1384 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: sizing our cache file %d to %d", fd
, sizeof(struct sharedspace_s
) );
1385 memset( &bob
, 0, sizeof(struct sharedspace_s
));
1386 write(fd
, &bob
, sizeof(struct sharedspace_s
));
1387 log_error(APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: done sizing our cache file to %d", sizeof(struct sharedspace_s
) );
1390 /* mmap the region */
1392 if ( ( sharedspace
= (struct sharedspace_s
*) mmap ( NULL
, sizeof(struct sharedspace_s
), PROT_READ
|PROT_WRITE
, MAP_SHARED
, fd
, 0 ) ) != -1 ) {
1393 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: shared mmap region ok %d", sharedspace
);
1396 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: mmap failed %d", errno
);
1402 #define locktype pthread_rwlock_t
1404 #define locktype rwlock_t
1407 /* mmap our shared space for our lock */
1408 if ( sharedlock
= ( locktype
* ) mmap ( NULL
, sizeof(locktype
), PROT_READ
|PROT_WRITE
, MAP_SHARED
|MAP_ANON
, -1, 0 ) ) {
1409 #ifndef use_pthreads
1410 rwlock_init(sharedlock
, USYNC_PROCESS
, NULL
);
1412 pthread_rwlockattr_init(&rwlock_attr
);
1413 pthread_rwlockattr_setpshared(&rwlock_attr
, PTHREAD_PROCESS_SHARED
);
1414 pthread_rwlock_init(sharedlock
, &rwlock_attr
);
1417 log_error( APLOG_MARK
, APLOG_DEBUG
, 0, s
, "mod_waklog: rwlock mmap failed %d", errno
);
1422 /* set our default tokens */
1424 getModConfig (cfg
, s
);
1426 oldrenewcount
= sharedspace
->renewcount
;
1428 pag_for_children
= 0;
1430 pid
= ap_bspawn_child (p
, waklog_child_routine
, s
, kill_always
,
1433 pag_for_children
= 1;
1435 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, s
,
1436 "mod_waklog: ap_bspawn_child: %d.", pid
);
1438 if ( use_existing
== 0 ) {
1439 /* wait here until our child process has gone and done it's renewing thing. */
1440 while( sharedspace
->renewcount
== oldrenewcount
) {
1441 log_error( APLOG_MARK
, APLOG_ERR
, 0, s
, "mod_waklog: waiting for tokens..." );
1446 if ( cfg
->default_principal
) {
1447 set_auth( s
, NULL
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1454 waklog_phase0 (request_rec
* r
)
1458 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1459 "mod_waklog: phase0 called");
1461 cfg
= retrieve_config(r
);
1463 if ( cfg
->protect
&& cfg
->principal
) {
1464 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase0 using user %s", cfg
->principal
);
1465 set_auth(r
->server
, r
, 0, cfg
->principal
, cfg
->keytab
, 0);
1466 } else if ( cfg
->default_principal
) {
1467 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase0 using default user %s", cfg
->default_principal
);
1468 set_auth(r
->server
, r
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1470 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase0 not doing nothin.");
1477 waklog_phase1 (request_rec
* r
)
1481 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1482 "mod_waklog: phase1 called");
1484 cfg
= retrieve_config(r
);
1486 if ( cfg
->protect
&& cfg
->principal
) {
1487 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase1 using user %s", cfg
->principal
);
1488 set_auth(r
->server
, r
, 0, cfg
->principal
, cfg
->keytab
, 0);
1489 } else if ( cfg
->default_principal
) {
1490 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase1 using default user %s", cfg
->default_principal
);
1491 set_auth(r
->server
, r
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1493 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase1 not doing nothin.");
1500 waklog_phase3 (request_rec
* r
)
1504 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1505 "mod_waklog: phase 3 called");
1507 cfg
= retrieve_config(r
);
1509 if ( cfg
->protect
&& cfg
->principal
) {
1510 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase3 using user %s", cfg
->principal
);
1511 set_auth(r
->server
, r
, 0, cfg
->principal
, cfg
->keytab
, 0);
1512 } else if ( cfg
->default_principal
) {
1513 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase3 using default user %s", cfg
->default_principal
);
1514 set_auth(r
->server
, r
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1516 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase3 not doing nothin.");
1523 waklog_phase6 (request_rec
* r
)
1527 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1528 "mod_waklog: phase6 called");
1530 cfg
= retrieve_config(r
);
1532 if ( cfg
->protect
&& cfg
->principal
) {
1533 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase6 using user %s", cfg
->principal
);
1534 set_auth(r
->server
, r
, 0, cfg
->principal
, cfg
->keytab
, 0);
1535 } else if ( cfg
->default_principal
) {
1536 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase6 using default user %s", cfg
->default_principal
);
1537 set_auth(r
->server
, r
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1539 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase6 not doing nothin.");
1546 waklog_phase7 (request_rec
* r
)
1551 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1552 "mod_waklog: phase7 called");
1554 cfg
= retrieve_config (r
);
1556 if ( cfg
->protect
&& cfg
->usertokens
) {
1557 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase7 using usertokens");
1558 rc
= set_auth( r
->server
, r
, 1, NULL
, NULL
, 0);
1559 } else if ( cfg
->protect
&& cfg
->principal
) {
1560 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase7 using user %s", cfg
->principal
);
1561 rc
= set_auth( r
->server
, r
, 0, cfg
->principal
, cfg
->keytab
, 0);
1562 } else if ( cfg
->default_principal
) {
1563 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase7 using default user %s", cfg
->default_principal
);
1564 rc
= set_auth( r
->server
, r
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1575 waklog_phase9 (request_rec
* r
)
1579 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1580 "mod_waklog: phase9 called");
1582 getModConfig (cfg
, r
->server
);
1584 if ( cfg
->default_principal
) {
1585 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
, "mod_waklog: phase9 using default user %s", cfg
->default_principal
);
1586 set_auth( r
->server
, r
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1599 waklog_new_connection (conn_rec
* c
1608 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, c
->base_server
,
1609 "mod_waklog: new_connection called: pid: %d", getpid ());
1611 getModConfig(cfg
, c
->base_server
);
1613 if ( cfg
->default_principal
) {
1614 log_error(APLOG_MARK
, APLOG_DEBUG
, 0, c
->base_server
, "mod_waklog: new conn setting default user %s",
1615 cfg
->default_principal
);
1616 set_auth( c
->base_server
, NULL
, 0, cfg
->default_principal
, cfg
->default_keytab
, 0);
1629 ** Here's a quick explaination for phase0 and phase2:
1630 ** Apache does a stat() on the path between phase0 and
1631 ** phase2, and must by ACLed rl to succeed. So, at
1632 ** phase0 we acquire credentials for umweb:servers from
1633 ** a keytab, and at phase2 we must ensure we remove them.
1635 ** Failure to "unlog" would be a security risk.
1638 waklog_phase2 (request_rec
* r
)
1641 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1642 "mod_waklog: phase2 called");
1644 if (child
.token
.ticketLen
)
1646 memset (&child
.token
, 0, sizeof (struct ktc_token
));
1648 ktc_ForgetAllTokens ();
1650 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1651 "mod_waklog: ktc_ForgetAllTokens succeeded: pid: %d",
1655 log_error (APLOG_MARK
, APLOG_DEBUG
, 0, r
->server
,
1656 "mod_waklog: phase2 returning");
1662 module MODULE_VAR_EXPORT waklog_module
= {
1663 STANDARD_MODULE_STUFF
,
1664 waklog_init
, /* module initializer */
1665 waklog_create_dir_config
, /* create per-dir config structures */
1666 waklog_merge_dir_config
, /* merge per-dir config structures */
1667 waklog_create_server_config
, /* create per-server config structures */
1668 waklog_merge_dir_config
, /* merge per-server config structures */
1669 waklog_cmds
, /* table of config file commands */
1670 NULL
, /* [#8] MIME-typed-dispatched handlers */
1671 waklog_phase1
, /* [#1] URI to filename translation */
1672 NULL
, /* [#4] validate user id from request */
1673 NULL
, /* [#5] check if the user is ok _here_ */
1674 waklog_phase3
, /* [#3] check access by host address */
1675 waklog_phase6
, /* [#6] determine MIME type */
1676 waklog_phase7
, /* [#7] pre-run fixups */
1677 waklog_phase9
, /* [#9] log a transaction */
1678 NULL
, /* [#2] header parser */
1679 waklog_child_init
, /* child_init */
1680 waklog_child_exit
, /* child_exit */
1681 waklog_phase0
/* [#0] post read-request */
1683 , NULL
, /* EAPI: add_module */
1684 NULL
, /* EAPI: remove_module */
1685 NULL
, /* EAPI: rewrite_command */
1686 waklog_new_connection
/* EAPI: new_connection */
1691 waklog_register_hooks (apr_pool_t
* p
)
1693 ap_hook_translate_name (waklog_phase1
, NULL
, NULL
, APR_HOOK_FIRST
);
1694 ap_hook_header_parser (waklog_phase2
, NULL
, NULL
, APR_HOOK_FIRST
);
1695 ap_hook_access_checker (waklog_phase3
, NULL
, NULL
, APR_HOOK_FIRST
);
1696 ap_hook_type_checker (waklog_phase6
, NULL
, NULL
, APR_HOOK_FIRST
);
1697 ap_hook_fixups (waklog_phase7
, NULL
, NULL
, APR_HOOK_FIRST
);
1698 ap_hook_log_transaction (waklog_phase9
, NULL
, NULL
, APR_HOOK_FIRST
);
1699 ap_hook_child_init (waklog_child_init
, NULL
, NULL
, APR_HOOK_FIRST
);
1700 ap_hook_post_read_request (waklog_phase0
, NULL
, NULL
, APR_HOOK_FIRST
);
1701 ap_hook_pre_connection (waklog_new_connection
, NULL
, NULL
, APR_HOOK_FIRST
);
1702 ap_hook_post_config (waklog_init_handler
, NULL
, NULL
, APR_HOOK_MIDDLE
);
1706 module AP_MODULE_DECLARE_DATA waklog_module
= {
1707 STANDARD20_MODULE_STUFF
,
1708 waklog_create_dir_config
, /* create per-dir conf structures */
1709 waklog_merge_dir_config
, /* merge per-dir conf structures */
1710 waklog_create_server_config
, /* create per-server conf structures */
1711 waklog_merge_dir_config
, /* merge per-server conf structures */
1712 waklog_cmds
, /* table of configuration directives */
1713 waklog_register_hooks
/* register hooks */