jlcyr/ABSEC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first pass cleanup code

Browse Source
This commit is contained in:
Jean-Luc Cyr
2018-07-04 13:19:09 -04:00
parent 5d05c63644
commit 5620977d66
1 changed files with 76 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod_absec.c
+49 -72
View File
@@ -1,12 +1,12 @@
/* /*
** mod_absec.c -- Apache sample absec module ** mod_absec.c -- Apache absec module
** [Autogenerated via ``apxs -n absec -g''] ** [base Autogenerated via ``apxs -n absec -g'']
** **
** To play with this sample module first compile it into a ** To play with this sample module first compile it into a
** DSO file and install it into Apache's modules directory ** DSO file and install it into Apache's modules directory
** by running: ** by running:
** **
** $ apxs -c -i mod_absec.c ** $ apxs -lpam -lpam_misc -c -i mod_absec.c
** **
** Then activate it in Apache's httpd.conf file for instance ** Then activate it in Apache's httpd.conf file for instance
** for the URL /absec in as follows: ** for the URL /absec in as follows:
@@ -21,25 +21,11 @@
** **
** $ apachectl restart ** $ apachectl restart
** **
** you immediately can request the URL /absec and watch for the
** output of this module. This can be achieved for instance via:
**
** $ lynx -mime_header http://localhost/absec
**
** The output should be similar to the following one:
**
** HTTP/1.1 200 OK
** Date: Tue, 31 Mar 1998 14:42:22 GMT
** Server: Apache/1.3.4 (Unix)
** Connection: close
** Content-Type: text/html
**
** The sample page from mod_absec.c
*/ */
/* /*
TEST URL TEST URL
http://10.211.55.15/absec?joe=blow http://10.211.55.15/absec/<fichier>
INFORMATION SOURCES INFORMATION SOURCES
@@ -89,21 +75,19 @@ static int check_autorization(request_rec *r)
return 0; return 0;
} }
//int function_conversation ( ) { // Global var for passing fake response to PAM callback
/* ToDo prompt user for input */
//};
//struct pam_conv conv = { function_conversation, 0 };
struct pam_response *reply; struct pam_response *reply;
////////////////////////////////////////////////////////////////
// PAM response callback function
int converse(int n, const struct pam_message **msg, int converse(int n, const struct pam_message **msg,
struct pam_response **resp, void *data) struct pam_response **resp, void *data)
{ {
// Return globally set response
*resp = reply; *resp = reply;
return PAM_SUCCESS; return PAM_SUCCESS;
// Real code for responding and asking user values
struct pam_response *aresp; struct pam_response *aresp;
char buf[PAM_MAX_RESP_SIZE]; char buf[PAM_MAX_RESP_SIZE];
int i; int i;
@@ -118,17 +102,17 @@ int converse(int n, const struct pam_message **msg,
aresp[i].resp = NULL; aresp[i].resp = NULL;
switch (msg[i]->msg_style) { switch (msg[i]->msg_style) {
case PAM_PROMPT_ECHO_OFF: case PAM_PROMPT_ECHO_OFF:
aresp[i].resp = strdup("jlcyrpass01!"); //aresp[i].resp = strdup("jlcyrpass01!");
//aresp[i].resp = strdup(getpass(msg[i]->msg)); aresp[i].resp = strdup(getpass(msg[i]->msg));
if (aresp[i].resp == NULL) if (aresp[i].resp == NULL)
goto fail; goto fail;
break; break;
case PAM_PROMPT_ECHO_ON: case PAM_PROMPT_ECHO_ON:
fputs(msg[i]->msg, stderr); fputs(msg[i]->msg, stderr);
//if (fgets(buf, sizeof buf, stdin) == NULL) if (fgets(buf, sizeof buf, stdin) == NULL)
// goto fail; goto fail;
//aresp[i].resp = strdup(buf); aresp[i].resp = strdup(buf);
aresp[i].resp = strdup("jlcyrpass01!"); //aresp[i].resp = strdup("jlcyrpass01!");
if (aresp[i].resp == NULL) if (aresp[i].resp == NULL)
goto fail; goto fail;
break; break;
@@ -162,10 +146,12 @@ int converse(int n, const struct pam_message **msg,
return (PAM_CONV_ERR); return (PAM_CONV_ERR);
} }
////////////////////////////////////////////////////////////////
// define PAM callback function
struct pam_conv conv = { converse, 0 }; struct pam_conv conv = { converse, 0 };
//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////
/* Main routine */ /* Main routine - called after request processing */
static int absec_handler_last(request_rec *r) static int absec_handler_last(request_rec *r)
{ {
// Is this module really called? // Is this module really called?
@@ -179,7 +165,7 @@ static int absec_handler_last(request_rec *r)
} }
//////////////////////////////////////////////////////////////// ////////////////////////////////////////////////////////////////
/* Main routine */ /* Main routine - called before request processing */
static int absec_handler_first(request_rec *r) static int absec_handler_first(request_rec *r)
{ {
// Is this module really called? // Is this module really called?
@@ -187,8 +173,8 @@ static int absec_handler_first(request_rec *r)
return DECLINED; return DECLINED;
} }
//////// ////////
/* http method validate the perm asked (r/w vs get/post,put) */ /* http method validate the perm asked (r/w vs get/post,put) */
ap_rprintf(r, "Before Method: %s<br/>\r\n", r->method); ap_rprintf(r, "Before Method: %s<br/>\r\n", r->method);
int permmask = 0; int permmask = 0;
if (strcmp(r->method,"GET")==0) permmask=0444; // r if (strcmp(r->method,"GET")==0) permmask=0444; // r
@@ -196,9 +182,9 @@ static int absec_handler_first(request_rec *r)
if (strcmp(r->method,"POST")==0) permmask=0222; // w if (strcmp(r->method,"POST")==0) permmask=0222; // w
if (strcmp(r->method,"DELETE")==0) permmask=0111; // x if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
//////// ////////
/* check file permission on filesystem */ /* check file permission on filesystem */
/* should include <sys/stat.h> */ /* should include <sys/stat.h> */
struct stat fperm; struct stat fperm;
int status; int status;
status = stat(r->filename, &fperm); status = stat(r->filename, &fperm);
@@ -219,8 +205,8 @@ static int absec_handler_first(request_rec *r)
return (DECLINED); return (DECLINED);
} }
//////// ////////
/* Check if we have a basic auth user */ /* Check if we have a basic auth user */
const char* auth64p; const char* auth64p;
// Check if we have an auth header // Check if we have an auth header
auth64p = apr_table_get(r->headers_in,"Authorization"); auth64p = apr_table_get(r->headers_in,"Authorization");
@@ -236,8 +222,8 @@ static int absec_handler_first(request_rec *r)
return HTTP_UNAUTHORIZED; return HTTP_UNAUTHORIZED;
} }
//////// ////////
/* Retrieve user/pass from http basic auth header */ /* Retrieve user/pass from http basic auth header */
// Get the basic auth base64 string and decode it // Get the basic auth base64 string and decode it
// Start at char 6 to skip 'Basic ' // Start at char 6 to skip 'Basic '
char *auth64; char *auth64;
@@ -257,18 +243,18 @@ static int absec_handler_first(request_rec *r)
//ap_rprintf(r, "Headers Authorization: %s \n<br/>", auth64); //ap_rprintf(r, "Headers Authorization: %s \n<br/>", auth64);
//ap_rprintf(r, "User/Pass: %s/%s \n<br/>", user, pass); //ap_rprintf(r, "User/Pass: %s/%s \n<br/>", user, pass);
//////// ////////
// Get UID, GIDs for the user // Get UID, GIDs for the user
/* Working example, but just UID not PW */ /* Working example, but just UID not PW */
apr_status_t ret; apr_status_t ret;
apr_uid_t i; apr_uid_t i;
apr_gid_t g; apr_gid_t g;
ret = apr_uid_get ( &i, &g, user, r->pool ); ret = apr_uid_get ( &i, &g, user, r->pool );
ap_rprintf(r, "Result2: G:%d, I:%d \n<br/>", g,i); ap_rprintf(r, "Result2: G:%d, I:%d \n<br/>", g,i);
//////// ////////
/* Retrieve PW from /etc/passwd */ /* Retrieve PW from /etc/passwd */
/* Should include <pwd.h> */ /* Should include <pwd.h> */
struct passwd *pw; struct passwd *pw;
if((pw = getpwnam(user)) == NULL) if((pw = getpwnam(user)) == NULL)
{ {
@@ -285,9 +271,9 @@ static int absec_handler_first(request_rec *r)
ap_rprintf(r, "Unix PW : %s \n<br/>", pw->pw_passwd); ap_rprintf(r, "Unix PW : %s \n<br/>", pw->pw_passwd);
} }
//////// ////////
/* Retrieve PW from /etc/shadow */ /* Retrieve PW from /etc/shadow */
/* Should include <shadow.h> */ /* Should include <shadow.h> */
/* struct spwd *spw; /* struct spwd *spw;
errno = 0; errno = 0;
if((spw = getspnam(user)) == NULL) if((spw = getspnam(user)) == NULL)
@@ -314,6 +300,7 @@ static int absec_handler_first(request_rec *r)
return HTTP_UNAUTHORIZED; return HTTP_UNAUTHORIZED;
}*/ }*/
// Connect to PAM to auth user
pam_handle_t * pamh = NULL; pam_handle_t * pamh = NULL;
int rret; int rret;
@@ -322,18 +309,12 @@ static int absec_handler_first(request_rec *r)
printf("Pam start failed\n"); printf("Pam start failed\n");
exit(0); exit(0);
} }
/* if((rret = pam_set_item( pamh, PAM_AUTHTOK, &pass)) == PAM_BUF_ERR) {
return HTTP_BAD_REQUEST;
}
*/
// Set the PAM callback function response (would call for password)
reply = (struct pam_response *)malloc(sizeof(struct pam_response)); reply = (struct pam_response *)malloc(sizeof(struct pam_response));
reply[0].resp = strdup(pass); // password received in basic auth
// *** Get the password by any method, or maybe it was passed into this function.
reply[0].resp = strdup(pass);
reply[0].resp_retcode = 0; reply[0].resp_retcode = 0;
if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) { if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
return HTTP_UNAUTHORIZED; return HTTP_UNAUTHORIZED;
printf("User auth failed\n"); printf("User auth failed\n");
@@ -347,12 +328,11 @@ static int absec_handler_first(request_rec *r)
exit(1); exit(1);
} }
//////// ////////
/* Encrypt and compare shadow password */ /* Encrypt and compare shadow password */
// TODO : Valider qu'on a un user
// TODO : Valider qu'on a un user // TODO : Valider qu'il y a un password (pas * ! rien)
// TODO : Valider qu'il y a un password (pas * ! rien) /* char *encrypted;
/* char *encrypted;
const char *correct; const char *correct;
int rrr; int rrr;
encrypted = crypt(pass, spw->sp_pwdp); encrypted = crypt(pass, spw->sp_pwdp);
@@ -380,14 +360,11 @@ static int absec_handler_first(request_rec *r)
ap_rprintf(r, "Fichier groupe<br/>\r\n"); ap_rprintf(r, "Fichier groupe<br/>\r\n");
return (DECLINED); return (DECLINED);
} }
return HTTP_OK; return HTTP_OK;
////////
/* Check supplemental groups */
/* Should include <grp.h> */
////////
/* Check supplemental groups */
/* Should include <grp.h> */
//ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400); //ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
gid_t grouplist[16]; gid_t grouplist[16];
int grouplistsize = 16; int grouplistsize = 16;