From e5916f2e298af3db0eb957d64a84803d272bcc52 Mon Sep 17 00:00:00 2001
From: Jean-Luc Cyr <me@jlcyr.com>
Date: Tue, 3 Jul 2018 12:50:22 -0400
Subject: [PATCH] utilisation de PAM

---
 mod_absec.c | 66 +++++++++++++++++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 58 insertions(+), 8 deletions(-)

diff --git a/mod_absec.c b/mod_absec.c
index 6ca7fce..c0bacbe 100644
--- a/mod_absec.c
+++ b/mod_absec.c
@@ -72,6 +72,9 @@
 #include <shadow.h>
 #include <sys/stat.h>
 
+#include <security/pam_appl.h>
+#include <security/pam_misc.h>
+
 ////////////////////////////////////////////////////////////////
 /* Check user autentication against unix user/pass */
 static int check_autentication(request_rec *r)
@@ -86,10 +89,29 @@ static int check_autorization(request_rec *r)
     return 0;
 }
 
+//int function_conversation ( ) {
+     /* ToDo prompt user for input */ 
+//};
+//struct pam_conv conv = { function_conversation, 0 };
+struct pam_conv conv = { misc_conv, 0 };
 
 ////////////////////////////////////////////////////////////////
 /* Main routine */
-static int absec_handler(request_rec *r)
+static int absec_handler_last(request_rec *r)
+{
+    // Is this module really called?
+    if (strcmp(r->handler, "absec")) {
+        return DECLINED;
+    }
+    r->content_type = "text/html";      
+    //ap_rprintf(r, "The sample page from mod_absec.c %s \n<br/>", r->args);
+    ap_rprintf(r, "After Url: %s from %s \n<br/>", r->filename, r->uri);
+    return (OK);
+}
+
+////////////////////////////////////////////////////////////////
+/* Main routine */
+static int absec_handler_first(request_rec *r)
 {
     // Is this module really called?
     if (strcmp(r->handler, "absec")) {
@@ -98,7 +120,7 @@ static int absec_handler(request_rec *r)
 
 ////////
 /* http method validate the perm asked (r/w vs get/post,put) */
-    ap_rprintf(r, "Method: %s<br/>\r\n", r->method);
+    ap_rprintf(r, "Before Method: %s<br/>\r\n", r->method);
     int permmask = 0;
     if (strcmp(r->method,"GET")==0) permmask=0444;     // r
     if (strcmp(r->method,"PUT")==0) permmask=0222;     // w
@@ -197,7 +219,7 @@ static int absec_handler(request_rec *r)
 ////////
 /* Retrieve PW from /etc/shadow */
 /* Should include <shadow.h> */
-    struct spwd *spw; 
+/*    struct spwd *spw; 
     errno = 0;
     if((spw = getspnam(user)) == NULL) 
     { 
@@ -221,14 +243,39 @@ static int absec_handler(request_rec *r)
                 apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
                             "\"", NULL));
         return HTTP_UNAUTHORIZED;
-    }
+    }*/
+
+   pam_handle_t * pamh = NULL;
+   int rret;
+
+   if((rret = pam_start("httpd", pw->pw_name, &conv, &pamh)) != PAM_SUCCESS) {
+       return HTTP_INTERNAL_SERVER_ERROR;
+      printf("Pam start failed\n"); 
+      exit(0);
+   }
+    if((rret = pam_set_item( pamh, PAM_AUTHTOK, &pass)) == PAM_BUF_ERR) {
+          return HTTP_BAD_REQUEST;
+      }
+   if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
+       return HTTP_UNAUTHORIZED;
+      printf("User auth failed\n"); exit(0);
+   }
+ 
+   if(pam_end(pamh, rret) != PAM_SUCCESS) {
+      //perror("pam_end");
+      pamh = NULL; 
+      return HTTP_INTERNAL_SERVER_ERROR;exit(1);
+   }
+return HTTP_OK;
+
+
 
 ////////
 /* Encrypt and compare shadow password */
 
 // TODO : Valider qu'on a un user
 // TODO : Valider qu'il y a un password (pas * ! rien)
-    char *encrypted;
+ /*   char *encrypted;
     const char *correct;
     int rrr;
     encrypted = crypt(pass, spw->sp_pwdp);
@@ -243,7 +290,7 @@ static int absec_handler(request_rec *r)
                             "\"", NULL));
         return HTTP_UNAUTHORIZED;
     }
-
+*/
 
     // If file is user readable and user match return content
     if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) {
@@ -257,7 +304,9 @@ static int absec_handler(request_rec *r)
         return (DECLINED);
     }
 
-    // now check supplemental groups
+////////
+/* Check supplemental groups */
+/* Should include <grp.h> */
     //ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
     gid_t grouplist[16];
     int grouplistsize = 16;
@@ -294,7 +343,8 @@ static int absec_handler(request_rec *r)
 static void absec_register_hooks(apr_pool_t *p)
 {
     //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
-    ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_LAST);
+    ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST);
+    ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST);
 }
 
 ////////////////////////////////////////////////////////////////