From 5620977d66f41f330b22db1599ec323b01b71d97 Mon Sep 17 00:00:00 2001 From: Jean-Luc Cyr Date: Wed, 4 Jul 2018 13:19:09 -0400 Subject: [PATCH] first pass cleanup code --- mod_absec.c | 175 ++++++++++++++++++++++++++---------------------------------- 1 file changed, 76 insertions(+), 99 deletions(-) diff --git a/mod_absec.c b/mod_absec.c index 292f180..bbe3d4a 100644 --- a/mod_absec.c +++ b/mod_absec.c @@ -1,12 +1,12 @@ /* -** mod_absec.c -- Apache sample absec module -** [Autogenerated via ``apxs -n absec -g''] +** mod_absec.c -- Apache absec module +** [base Autogenerated via ``apxs -n absec -g''] ** ** To play with this sample module first compile it into a ** DSO file and install it into Apache's modules directory ** by running: ** -** $ apxs -c -i mod_absec.c +** $ apxs -lpam -lpam_misc -c -i mod_absec.c ** ** Then activate it in Apache's httpd.conf file for instance ** for the URL /absec in as follows: @@ -21,25 +21,11 @@ ** ** $ apachectl restart ** -** you immediately can request the URL /absec and watch for the -** output of this module. This can be achieved for instance via: -** -** $ lynx -mime_header http://localhost/absec -** -** The output should be similar to the following one: -** -** HTTP/1.1 200 OK -** Date: Tue, 31 Mar 1998 14:42:22 GMT -** Server: Apache/1.3.4 (Unix) -** Connection: close -** Content-Type: text/html -** -** The sample page from mod_absec.c */ /* TEST URL - http://10.211.55.15/absec?joe=blow + http://10.211.55.15/absec/ INFORMATION SOURCES @@ -89,21 +75,19 @@ static int check_autorization(request_rec *r) return 0; } -//int function_conversation ( ) { - /* ToDo prompt user for input */ -//}; -//struct pam_conv conv = { function_conversation, 0 }; - +// Global var for passing fake response to PAM callback struct pam_response *reply; - +//////////////////////////////////////////////////////////////// +// PAM response callback function int converse(int n, const struct pam_message **msg, struct pam_response **resp, void *data) { - *resp = reply; - return PAM_SUCCESS; - + // Return globally set response + *resp = reply; + return PAM_SUCCESS; + // Real code for responding and asking user values struct pam_response *aresp; char buf[PAM_MAX_RESP_SIZE]; int i; @@ -118,17 +102,17 @@ int converse(int n, const struct pam_message **msg, aresp[i].resp = NULL; switch (msg[i]->msg_style) { case PAM_PROMPT_ECHO_OFF: - aresp[i].resp = strdup("jlcyrpass01!"); - //aresp[i].resp = strdup(getpass(msg[i]->msg)); + //aresp[i].resp = strdup("jlcyrpass01!"); + aresp[i].resp = strdup(getpass(msg[i]->msg)); if (aresp[i].resp == NULL) goto fail; break; case PAM_PROMPT_ECHO_ON: fputs(msg[i]->msg, stderr); - //if (fgets(buf, sizeof buf, stdin) == NULL) - // goto fail; - //aresp[i].resp = strdup(buf); - aresp[i].resp = strdup("jlcyrpass01!"); + if (fgets(buf, sizeof buf, stdin) == NULL) + goto fail; + aresp[i].resp = strdup(buf); + //aresp[i].resp = strdup("jlcyrpass01!"); if (aresp[i].resp == NULL) goto fail; break; @@ -162,10 +146,12 @@ int converse(int n, const struct pam_message **msg, return (PAM_CONV_ERR); } +//////////////////////////////////////////////////////////////// +// define PAM callback function struct pam_conv conv = { converse, 0 }; //////////////////////////////////////////////////////////////// -/* Main routine */ +/* Main routine - called after request processing */ static int absec_handler_last(request_rec *r) { // Is this module really called? @@ -179,7 +165,7 @@ static int absec_handler_last(request_rec *r) } //////////////////////////////////////////////////////////////// -/* Main routine */ +/* Main routine - called before request processing */ static int absec_handler_first(request_rec *r) { // Is this module really called? @@ -187,8 +173,8 @@ static int absec_handler_first(request_rec *r) return DECLINED; } -//////// -/* http method validate the perm asked (r/w vs get/post,put) */ + //////// + /* http method validate the perm asked (r/w vs get/post,put) */ ap_rprintf(r, "Before Method: %s
\r\n", r->method); int permmask = 0; if (strcmp(r->method,"GET")==0) permmask=0444; // r @@ -196,9 +182,9 @@ static int absec_handler_first(request_rec *r) if (strcmp(r->method,"POST")==0) permmask=0222; // w if (strcmp(r->method,"DELETE")==0) permmask=0111; // x -//////// -/* check file permission on filesystem */ -/* should include */ + //////// + /* check file permission on filesystem */ + /* should include */ struct stat fperm; int status; status = stat(r->filename, &fperm); @@ -219,8 +205,8 @@ static int absec_handler_first(request_rec *r) return (DECLINED); } -//////// -/* Check if we have a basic auth user */ + //////// + /* Check if we have a basic auth user */ const char* auth64p; // Check if we have an auth header auth64p = apr_table_get(r->headers_in,"Authorization"); @@ -236,8 +222,8 @@ static int absec_handler_first(request_rec *r) return HTTP_UNAUTHORIZED; } -//////// -/* Retrieve user/pass from http basic auth header */ + //////// + /* Retrieve user/pass from http basic auth header */ // Get the basic auth base64 string and decode it // Start at char 6 to skip 'Basic ' char *auth64; @@ -257,18 +243,18 @@ static int absec_handler_first(request_rec *r) //ap_rprintf(r, "Headers Authorization: %s \n
", auth64); //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass); -//////// -// Get UID, GIDs for the user -/* Working example, but just UID not PW */ + //////// + // Get UID, GIDs for the user + /* Working example, but just UID not PW */ apr_status_t ret; apr_uid_t i; apr_gid_t g; ret = apr_uid_get ( &i, &g, user, r->pool ); ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i); -//////// -/* Retrieve PW from /etc/passwd */ -/* Should include */ + //////// + /* Retrieve PW from /etc/passwd */ + /* Should include */ struct passwd *pw; if((pw = getpwnam(user)) == NULL) { @@ -285,9 +271,9 @@ static int absec_handler_first(request_rec *r) ap_rprintf(r, "Unix PW : %s \n
", pw->pw_passwd); } -//////// -/* Retrieve PW from /etc/shadow */ -/* Should include */ + //////// + /* Retrieve PW from /etc/shadow */ + /* Should include */ /* struct spwd *spw; errno = 0; if((spw = getspnam(user)) == NULL) @@ -314,45 +300,39 @@ static int absec_handler_first(request_rec *r) return HTTP_UNAUTHORIZED; }*/ - pam_handle_t * pamh = NULL; - int rret; + // Connect to PAM to auth user + pam_handle_t * pamh = NULL; + int rret; - if((rret = pam_start("httpd", pw->pw_name, &conv, &pamh)) != PAM_SUCCESS) { - return HTTP_INTERNAL_SERVER_ERROR; - printf("Pam start failed\n"); - exit(0); - } -/* if((rret = pam_set_item( pamh, PAM_AUTHTOK, &pass)) == PAM_BUF_ERR) { - return HTTP_BAD_REQUEST; - } -*/ + if((rret = pam_start("httpd", pw->pw_name, &conv, &pamh)) != PAM_SUCCESS) { + return HTTP_INTERNAL_SERVER_ERROR; + printf("Pam start failed\n"); + exit(0); + } - reply = (struct pam_response *)malloc(sizeof(struct pam_response)); + // Set the PAM callback function response (would call for password) + reply = (struct pam_response *)malloc(sizeof(struct pam_response)); + reply[0].resp = strdup(pass); // password received in basic auth + reply[0].resp_retcode = 0; - // *** Get the password by any method, or maybe it was passed into this function. - reply[0].resp = strdup(pass); - reply[0].resp_retcode = 0; + if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) { + return HTTP_UNAUTHORIZED; + printf("User auth failed\n"); + exit(0); + } + if(pam_end(pamh, rret) != PAM_SUCCESS) { + //perror("pam_end"); + pamh = NULL; + return HTTP_INTERNAL_SERVER_ERROR; + exit(1); + } - if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) { - return HTTP_UNAUTHORIZED; - printf("User auth failed\n"); - exit(0); - } - - if(pam_end(pamh, rret) != PAM_SUCCESS) { - //perror("pam_end"); - pamh = NULL; - return HTTP_INTERNAL_SERVER_ERROR; - exit(1); - } - -//////// -/* Encrypt and compare shadow password */ - -// TODO : Valider qu'on a un user -// TODO : Valider qu'il y a un password (pas * ! rien) - /* char *encrypted; + //////// + /* Encrypt and compare shadow password */ + // TODO : Valider qu'on a un user + // TODO : Valider qu'il y a un password (pas * ! rien) +/* char *encrypted; const char *correct; int rrr; encrypted = crypt(pass, spw->sp_pwdp); @@ -380,14 +360,11 @@ static int absec_handler_first(request_rec *r) ap_rprintf(r, "Fichier groupe
\r\n"); return (DECLINED); } -return HTTP_OK; + return HTTP_OK; - - - -//////// -/* Check supplemental groups */ -/* Should include */ + //////// + /* Check supplemental groups */ + /* Should include */ //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400); gid_t grouplist[16]; int grouplistsize = 16; @@ -410,11 +387,11 @@ return HTTP_OK; // else decline ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); + apr_table_setn(r->err_headers_out, + (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" + : "WWW-Authenticate", + apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), + "\"", NULL)); return HTTP_UNAUTHORIZED; return OK;