jlcyr/ABSEC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

first pass cleanup code

Browse Source
This commit is contained in:
Jean-Luc Cyr
2018-07-04 13:19:09 -04:00
parent 5d05c63644
commit 5620977d66
1 changed files with 76 additions and 99 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod_absec.c
+76 -99
View File
@@ -1,12 +1,12 @@
/*
** mod_absec.c -- Apache sample absec module
** [Autogenerated via ``apxs -n absec -g'']
** mod_absec.c -- Apache absec module
** [base Autogenerated via ``apxs -n absec -g'']
**
** To play with this sample module first compile it into a
** DSO file and install it into Apache's modules directory
** by running:
**
** $ apxs -c -i mod_absec.c
** $ apxs -lpam -lpam_misc -c -i mod_absec.c
**
** Then activate it in Apache's httpd.conf file for instance
** for the URL /absec in as follows:
@@ -21,25 +21,11 @@
**
** $ apachectl restart
**
** you immediately can request the URL /absec and watch for the
** output of this module. This can be achieved for instance via:
**
** $ lynx -mime_header http://localhost/absec
**
** The output should be similar to the following one:
**
** HTTP/1.1 200 OK
** Date: Tue, 31 Mar 1998 14:42:22 GMT
** Server: Apache/1.3.4 (Unix)
** Connection: close
** Content-Type: text/html
**
** The sample page from mod_absec.c
*/
/*
TEST URL
http://10.211.55.15/absec?joe=blow
http://10.211.55.15/absec/<fichier>
INFORMATION SOURCES
@@ -89,21 +75,19 @@ static int check_autorization(request_rec *r)
return 0;
}
//int function_conversation ( ) {
/* ToDo prompt user for input */
//};
//struct pam_conv conv = { function_conversation, 0 };
// Global var for passing fake response to PAM callback
struct pam_response *reply;
////////////////////////////////////////////////////////////////
// PAM response callback function
int converse(int n, const struct pam_message **msg,
struct pam_response **resp, void *data)
{
*resp = reply;
return PAM_SUCCESS;
// Return globally set response
*resp = reply;
return PAM_SUCCESS;
// Real code for responding and asking user values
struct pam_response *aresp;
char buf[PAM_MAX_RESP_SIZE];
int i;
@@ -118,17 +102,17 @@ int converse(int n, const struct pam_message **msg,
aresp[i].resp = NULL;
switch (msg[i]->msg_style) {
case PAM_PROMPT_ECHO_OFF:
aresp[i].resp = strdup("jlcyrpass01!");
//aresp[i].resp = strdup(getpass(msg[i]->msg));
//aresp[i].resp = strdup("jlcyrpass01!");
aresp[i].resp = strdup(getpass(msg[i]->msg));
if (aresp[i].resp == NULL)
goto fail;
break;
case PAM_PROMPT_ECHO_ON:
fputs(msg[i]->msg, stderr);
//if (fgets(buf, sizeof buf, stdin) == NULL)
// goto fail;
//aresp[i].resp = strdup(buf);
aresp[i].resp = strdup("jlcyrpass01!");
if (fgets(buf, sizeof buf, stdin) == NULL)
goto fail;
aresp[i].resp = strdup(buf);
//aresp[i].resp = strdup("jlcyrpass01!");
if (aresp[i].resp == NULL)
goto fail;
break;
@@ -162,10 +146,12 @@ int converse(int n, const struct pam_message **msg,
return (PAM_CONV_ERR);
}
////////////////////////////////////////////////////////////////
// define PAM callback function
struct pam_conv conv = { converse, 0 };
////////////////////////////////////////////////////////////////
/* Main routine */
/* Main routine - called after request processing */
static int absec_handler_last(request_rec *r)
{
// Is this module really called?
@@ -179,7 +165,7 @@ static int absec_handler_last(request_rec *r)
}
////////////////////////////////////////////////////////////////
/* Main routine */
/* Main routine - called before request processing */
static int absec_handler_first(request_rec *r)
{
// Is this module really called?
@@ -187,8 +173,8 @@ static int absec_handler_first(request_rec *r)
return DECLINED;
}
////////
/* http method validate the perm asked (r/w vs get/post,put) */
////////
/* http method validate the perm asked (r/w vs get/post,put) */
ap_rprintf(r, "Before Method: %s<br/>\r\n", r->method);
int permmask = 0;
if (strcmp(r->method,"GET")==0) permmask=0444; // r
@@ -196,9 +182,9 @@ static int absec_handler_first(request_rec *r)
if (strcmp(r->method,"POST")==0) permmask=0222; // w
if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
////////
/* check file permission on filesystem */
/* should include <sys/stat.h> */
////////
/* check file permission on filesystem */
/* should include <sys/stat.h> */
struct stat fperm;
int status;
status = stat(r->filename, &fperm);
@@ -219,8 +205,8 @@ static int absec_handler_first(request_rec *r)
return (DECLINED);
}
////////
/* Check if we have a basic auth user */
////////
/* Check if we have a basic auth user */
const char* auth64p;
// Check if we have an auth header
auth64p = apr_table_get(r->headers_in,"Authorization");
@@ -236,8 +222,8 @@ static int absec_handler_first(request_rec *r)
return HTTP_UNAUTHORIZED;
}
////////
/* Retrieve user/pass from http basic auth header */
////////
/* Retrieve user/pass from http basic auth header */
// Get the basic auth base64 string and decode it
// Start at char 6 to skip 'Basic '
char *auth64;
@@ -257,18 +243,18 @@ static int absec_handler_first(request_rec *r)
//ap_rprintf(r, "Headers Authorization: %s \n<br/>", auth64);
//ap_rprintf(r, "User/Pass: %s/%s \n<br/>", user, pass);
////////
// Get UID, GIDs for the user
/* Working example, but just UID not PW */
////////
// Get UID, GIDs for the user
/* Working example, but just UID not PW */
apr_status_t ret;
apr_uid_t i;
apr_gid_t g;
ret = apr_uid_get ( &i, &g, user, r->pool );
ap_rprintf(r, "Result2: G:%d, I:%d \n<br/>", g,i);
////////
/* Retrieve PW from /etc/passwd */
/* Should include <pwd.h> */
////////
/* Retrieve PW from /etc/passwd */
/* Should include <pwd.h> */
struct passwd *pw;
if((pw = getpwnam(user)) == NULL)
{
@@ -285,9 +271,9 @@ static int absec_handler_first(request_rec *r)
ap_rprintf(r, "Unix PW : %s \n<br/>", pw->pw_passwd);
}
////////
/* Retrieve PW from /etc/shadow */
/* Should include <shadow.h> */
////////
/* Retrieve PW from /etc/shadow */
/* Should include <shadow.h> */
/* struct spwd *spw;
errno = 0;
if((spw = getspnam(user)) == NULL)
@@ -314,45 +300,39 @@ static int absec_handler_first(request_rec *r)
return HTTP_UNAUTHORIZED;
}*/
pam_handle_t * pamh = NULL;
int rret;
// Connect to PAM to auth user
pam_handle_t * pamh = NULL;
int rret;
if((rret = pam_start("httpd", pw->pw_name, &conv, &pamh)) != PAM_SUCCESS) {
return HTTP_INTERNAL_SERVER_ERROR;
printf("Pam start failed\n");
exit(0);
}
/* if((rret = pam_set_item( pamh, PAM_AUTHTOK, &pass)) == PAM_BUF_ERR) {
return HTTP_BAD_REQUEST;
}
*/
if((rret = pam_start("httpd", pw->pw_name, &conv, &pamh)) != PAM_SUCCESS) {
return HTTP_INTERNAL_SERVER_ERROR;
printf("Pam start failed\n");
exit(0);
}
reply = (struct pam_response *)malloc(sizeof(struct pam_response));
// Set the PAM callback function response (would call for password)
reply = (struct pam_response *)malloc(sizeof(struct pam_response));
reply[0].resp = strdup(pass); // password received in basic auth
reply[0].resp_retcode = 0;
// *** Get the password by any method, or maybe it was passed into this function.
reply[0].resp = strdup(pass);
reply[0].resp_retcode = 0;
if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
return HTTP_UNAUTHORIZED;
printf("User auth failed\n");
exit(0);
}
if(pam_end(pamh, rret) != PAM_SUCCESS) {
//perror("pam_end");
pamh = NULL;
return HTTP_INTERNAL_SERVER_ERROR;
exit(1);
}
if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
return HTTP_UNAUTHORIZED;
printf("User auth failed\n");
exit(0);
}
if(pam_end(pamh, rret) != PAM_SUCCESS) {
//perror("pam_end");
pamh = NULL;
return HTTP_INTERNAL_SERVER_ERROR;
exit(1);
}
////////
/* Encrypt and compare shadow password */
// TODO : Valider qu'on a un user
// TODO : Valider qu'il y a un password (pas * ! rien)
/* char *encrypted;
////////
/* Encrypt and compare shadow password */
// TODO : Valider qu'on a un user
// TODO : Valider qu'il y a un password (pas * ! rien)
/* char *encrypted;
const char *correct;
int rrr;
encrypted = crypt(pass, spw->sp_pwdp);
@@ -380,14 +360,11 @@ static int absec_handler_first(request_rec *r)
ap_rprintf(r, "Fichier groupe<br/>\r\n");
return (DECLINED);
}
return HTTP_OK;
return HTTP_OK;
////////
/* Check supplemental groups */
/* Should include <grp.h> */
////////
/* Check supplemental groups */
/* Should include <grp.h> */
//ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
gid_t grouplist[16];
int grouplistsize = 16;
@@ -410,11 +387,11 @@ return HTTP_OK;
// else decline
ap_rprintf(r, "Aucuns droits de voir le fichier<br/>\r\n");
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
return OK;