diff --git a/mod_absec_a.c b/mod_absec_a.c deleted file mode 100644 index d43e184..0000000 --- a/mod_absec_a.c +++ /dev/null @@ -1,378 +0,0 @@ -/* -** mod_absec.c -- Apache sample absec module -** [Autogenerated via ``apxs -n absec -g''] -** -** To play with this sample module first compile it into a -** DSO file and install it into Apache's modules directory -** by running: -** -** $ apxs -c -i mod_absec.c -** -** Then activate it in Apache's httpd.conf file for instance -** for the URL /absec in as follows: -** -** # httpd.conf -** LoadModule absec_module modules/mod_absec.so -** -** SetHandler absec -** -** -** Then after restarting Apache via -** -** $ apachectl restart -** -*/ - -/* - TEST URL - http://10.211.55.15/absec?joe=blow - - INFORMATION SOURCES - - https://apr.apache.org/docs/apr/1.5/group__apr__strings.html - https://apr.apache.org/docs/apr-util/1.6/files.html - - https://httpd.apache.org/docs/2.4/developer/modguide.html - http://www.ziviani.net/2011/how-to-create-an-apache-module - - https://en.wikipedia.org/wiki/Basic_access_authentication - -*/ - -#include "httpd.h" -#include "http_config.h" -#include "http_core.h" -#include "http_protocol.h" -#include "ap_config.h" -#include "apr_base64.h" -#include "apr_strings.h" -#include "apr_portable.h" -#include "apr_user.h" - -#include -#include -#include -#include -#include "apr_want.h" - -#include -#include - -#include - -//////////////////////////////////////////////////////////////// -/* Check user autentication against unix user/pass */ -static int check_autentication(request_rec *r) -{ - return 0; -} - -//////////////////////////////////////////////////////////////// -/* Check check file perms */ -static int check_autorization(request_rec *r) -{ - return 0; -} - -//////////////////////////////////////////////////////////////// -// define PAM callback function -int mysql_lookup(request_rec *r, struct stat *fperm) -{ - MYSQL *conn; - MYSQL_RES *res; - MYSQL_ROW row; - - char *server = "localhost"; - char *user = "jlcyr"; - char *password = "password"; /* set me first */ - char *database = "absec"; - - conn = mysql_init(NULL); - - /* Connect to database */ - if (!mysql_real_connect(conn, server, - user, password, database, 0, NULL, 0)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - - char query[256]; - sprintf(query, "select * from urls where url='%s'", r->uri); - /* send SQL query */ - //if (mysql_query(conn, "show tables")) { - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(-1); - } - - res = mysql_use_result(conn); - - /* output table name */ - ap_rprintf(r, "MySQL data:\n
"); - int cnt = 0; - while ((row = mysql_fetch_row(res)) != NULL) { - ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3])); - fperm->st_uid = atoi(row[1]); - fperm->st_gid = atoi(row[2]); - fperm->st_mode = atoi(row[3]); - cnt = cnt + 1; - } - - if (cnt==0) { - sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri); - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - ap_rprintf(r, "Aucune donnee\n
"); - } - - /* close connection */ - mysql_free_result(res); - mysql_close(conn); - return(0); -} - -//////////////////////////////////////////////////////////////// -/* Main routine */ -static int absec_handler_last(request_rec *r) -{ - // Is this module really called? - if (strcmp(r->handler, "absec")) { - return DECLINED; - } - r->content_type = "text/html"; - //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args); - ap_rprintf(r, "After Url: %s from %s \n
", r->filename, r->uri); - return (OK); -} - -//////////////////////////////////////////////////////////////// -/* Main routine */ -static int absec_handler_first(request_rec *r) -{ - // Is this module really called? - if (strcmp(r->handler, "absec")) { - return DECLINED; - } - -//////// -/* http method validate the perm asked (r/w vs get/post,put) */ - ap_rprintf(r, "Method: %s
\r\n", r->method); - int permmask = 0; - if (strcmp(r->method,"GET")==0) permmask=0444; // r - if (strcmp(r->method,"PUT")==0) permmask=0222; // w - if (strcmp(r->method,"POST")==0) permmask=0222; // w - if (strcmp(r->method,"DELETE")==0) permmask=0111; // x - -//////// -/* check file permission on filesystem */ -/* should include */ - struct stat fperm; - int status; - //status = stat(r->filename, &fperm); - status = mysql_lookup(r, &fperm); - //ap_rprintf(r, "Result mysql: %d
\r\n", ); - if (status==-1) { - ap_rprintf(r, "stat erreur %d", errno); - return (OK); - } - //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status); - - /* check if any permission (ogw) match method (get r, put/post w, delete x) */ - if ((fperm.st_mode & permmask)==0) { - /* no permission match, return don't even have to check user perms */ - //ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask); - return (OK); - } - - // If file is world accessible for asked method return content - // TODO : if put/post/delete, must check BEFORE ACTION not AFTER!!! - if (fperm.st_mode & 0x7 & permmask) { - /* if so, return, no need to check user perms */ - //ap_rprintf(r, "Fichier public
\r\n"); - return (DECLINED); - } - -//////// -/* Check if we have a basic auth user */ - const char* auth64p; - // Check if we have an auth header - auth64p = apr_table_get(r->headers_in,"Authorization"); - - // If no basic auth, ask for one - if (auth64p==NULL) { - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - -//////// -/* Retrieve user/pass from http basic auth header */ - // Get the basic auth base64 string and decode it - // Start at char 6 to skip 'Basic ' - char *auth64; - auth64 = apr_pstrdup(r->pool, auth64p+6); - char *auth; - auth = apr_pcalloc(r->pool, 64); - apr_base64_decode(auth, auth64); - - // Validate user/pass against unix cred - char *user; - char *pass; - user = apr_strtok(auth, ":", &pass); - - r->content_type = "text/html"; - //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args); - ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri); - //ap_rprintf(r, "Headers Authorization: %s \n
", auth64); - //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass); - -//////// -// Get UID, GIDs for the user -/* Working example, but just UID not PW */ - apr_status_t ret; - apr_uid_t i; - apr_gid_t g; - ret = apr_uid_get ( &i, &g, user, r->pool ); - ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i); - -//////// -/* Retrieve PW from /etc/passwd */ -/* Should include */ - struct passwd *pw; - if((pw = getpwnam(user)) == NULL) - { - ap_rprintf(r, "NULL \n
"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - else - { - ap_rprintf(r, "Unix PW : %s \n
", pw->pw_passwd); - } - -//////// -/* Retrieve PW from /etc/shadow */ -/* Should include */ - struct spwd *spw; - errno = 0; - if((spw = getspnam(user)) == NULL) - { - ap_rprintf(r, "NULL %d\n
", errno); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - else - { - ap_rprintf(r, "Shadow PW : %s \n
", spw->sp_pwdp); - } - - if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') { - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - -//////// -/* Encrypt and compare shadow password */ - -// TODO : Valider qu'on a un user -// TODO : Valider qu'il y a un password (pas * ! rien) - char *encrypted; - const char *correct; - int rrr; - encrypted = crypt(pass, spw->sp_pwdp); - rrr = strcmp(encrypted, spw->sp_pwdp); - ap_rprintf(r, "compare pw : %s \n
", encrypted);; - ap_rprintf(r, "compare : %d \n
", rrr); - if (rrr!=0) { - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - - - // If file is user readable and user match return content - if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) { - ap_rprintf(r, "Fichier propriétaire
\r\n"); - return (DECLINED); - } - - // If file is group readable and primary group match return content - if ((fperm.st_gid==g) && (fperm.st_mode & 0070 & permmask)) { - ap_rprintf(r, "Fichier groupe
\r\n"); - return (DECLINED); - } - - // now check supplemental groups - //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400); - gid_t grouplist[16]; - int grouplistsize = 16; - int *groupreturn; - groupreturn = getgrouplist("jlcyr", g, grouplist, &grouplistsize); - if (groupreturn != -1) { - ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize); - for (i=0; i\r\n"); - return (DECLINED); - } - } - } else { - ap_rprintf(r, "Erreur
\r\n"); - return OK; - } - - // else decline - ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - return OK; - -} - -//////////////////////////////////////////////////////////////// -static void absec_register_hooks(apr_pool_t *p) -{ - //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE); - ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST); - ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST); -} - -//////////////////////////////////////////////////////////////// -/* Dispatch list for API hooks */ -module AP_MODULE_DECLARE_DATA absec_module = { - STANDARD20_MODULE_STUFF, - NULL, /* create per-dir config structures */ - NULL, /* merge per-dir config structures */ - NULL, /* create per-server config structures */ - NULL, /* merge per-server config structures */ - NULL, /* table of config file commands */ - absec_register_hooks /* register hooks */ -}; - diff --git a/mod_absec_b.c b/mod_absec_b.c deleted file mode 100644 index d43e184..0000000 --- a/mod_absec_b.c +++ /dev/null @@ -1,378 +0,0 @@ -/* -** mod_absec.c -- Apache sample absec module -** [Autogenerated via ``apxs -n absec -g''] -** -** To play with this sample module first compile it into a -** DSO file and install it into Apache's modules directory -** by running: -** -** $ apxs -c -i mod_absec.c -** -** Then activate it in Apache's httpd.conf file for instance -** for the URL /absec in as follows: -** -** # httpd.conf -** LoadModule absec_module modules/mod_absec.so -** -** SetHandler absec -** -** -** Then after restarting Apache via -** -** $ apachectl restart -** -*/ - -/* - TEST URL - http://10.211.55.15/absec?joe=blow - - INFORMATION SOURCES - - https://apr.apache.org/docs/apr/1.5/group__apr__strings.html - https://apr.apache.org/docs/apr-util/1.6/files.html - - https://httpd.apache.org/docs/2.4/developer/modguide.html - http://www.ziviani.net/2011/how-to-create-an-apache-module - - https://en.wikipedia.org/wiki/Basic_access_authentication - -*/ - -#include "httpd.h" -#include "http_config.h" -#include "http_core.h" -#include "http_protocol.h" -#include "ap_config.h" -#include "apr_base64.h" -#include "apr_strings.h" -#include "apr_portable.h" -#include "apr_user.h" - -#include -#include -#include -#include -#include "apr_want.h" - -#include -#include - -#include - -//////////////////////////////////////////////////////////////// -/* Check user autentication against unix user/pass */ -static int check_autentication(request_rec *r) -{ - return 0; -} - -//////////////////////////////////////////////////////////////// -/* Check check file perms */ -static int check_autorization(request_rec *r) -{ - return 0; -} - -//////////////////////////////////////////////////////////////// -// define PAM callback function -int mysql_lookup(request_rec *r, struct stat *fperm) -{ - MYSQL *conn; - MYSQL_RES *res; - MYSQL_ROW row; - - char *server = "localhost"; - char *user = "jlcyr"; - char *password = "password"; /* set me first */ - char *database = "absec"; - - conn = mysql_init(NULL); - - /* Connect to database */ - if (!mysql_real_connect(conn, server, - user, password, database, 0, NULL, 0)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - - char query[256]; - sprintf(query, "select * from urls where url='%s'", r->uri); - /* send SQL query */ - //if (mysql_query(conn, "show tables")) { - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(-1); - } - - res = mysql_use_result(conn); - - /* output table name */ - ap_rprintf(r, "MySQL data:\n
"); - int cnt = 0; - while ((row = mysql_fetch_row(res)) != NULL) { - ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3])); - fperm->st_uid = atoi(row[1]); - fperm->st_gid = atoi(row[2]); - fperm->st_mode = atoi(row[3]); - cnt = cnt + 1; - } - - if (cnt==0) { - sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri); - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - ap_rprintf(r, "Aucune donnee\n
"); - } - - /* close connection */ - mysql_free_result(res); - mysql_close(conn); - return(0); -} - -//////////////////////////////////////////////////////////////// -/* Main routine */ -static int absec_handler_last(request_rec *r) -{ - // Is this module really called? - if (strcmp(r->handler, "absec")) { - return DECLINED; - } - r->content_type = "text/html"; - //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args); - ap_rprintf(r, "After Url: %s from %s \n
", r->filename, r->uri); - return (OK); -} - -//////////////////////////////////////////////////////////////// -/* Main routine */ -static int absec_handler_first(request_rec *r) -{ - // Is this module really called? - if (strcmp(r->handler, "absec")) { - return DECLINED; - } - -//////// -/* http method validate the perm asked (r/w vs get/post,put) */ - ap_rprintf(r, "Method: %s
\r\n", r->method); - int permmask = 0; - if (strcmp(r->method,"GET")==0) permmask=0444; // r - if (strcmp(r->method,"PUT")==0) permmask=0222; // w - if (strcmp(r->method,"POST")==0) permmask=0222; // w - if (strcmp(r->method,"DELETE")==0) permmask=0111; // x - -//////// -/* check file permission on filesystem */ -/* should include */ - struct stat fperm; - int status; - //status = stat(r->filename, &fperm); - status = mysql_lookup(r, &fperm); - //ap_rprintf(r, "Result mysql: %d
\r\n", ); - if (status==-1) { - ap_rprintf(r, "stat erreur %d", errno); - return (OK); - } - //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status); - - /* check if any permission (ogw) match method (get r, put/post w, delete x) */ - if ((fperm.st_mode & permmask)==0) { - /* no permission match, return don't even have to check user perms */ - //ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask); - return (OK); - } - - // If file is world accessible for asked method return content - // TODO : if put/post/delete, must check BEFORE ACTION not AFTER!!! - if (fperm.st_mode & 0x7 & permmask) { - /* if so, return, no need to check user perms */ - //ap_rprintf(r, "Fichier public
\r\n"); - return (DECLINED); - } - -//////// -/* Check if we have a basic auth user */ - const char* auth64p; - // Check if we have an auth header - auth64p = apr_table_get(r->headers_in,"Authorization"); - - // If no basic auth, ask for one - if (auth64p==NULL) { - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - -//////// -/* Retrieve user/pass from http basic auth header */ - // Get the basic auth base64 string and decode it - // Start at char 6 to skip 'Basic ' - char *auth64; - auth64 = apr_pstrdup(r->pool, auth64p+6); - char *auth; - auth = apr_pcalloc(r->pool, 64); - apr_base64_decode(auth, auth64); - - // Validate user/pass against unix cred - char *user; - char *pass; - user = apr_strtok(auth, ":", &pass); - - r->content_type = "text/html"; - //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args); - ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri); - //ap_rprintf(r, "Headers Authorization: %s \n
", auth64); - //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass); - -//////// -// Get UID, GIDs for the user -/* Working example, but just UID not PW */ - apr_status_t ret; - apr_uid_t i; - apr_gid_t g; - ret = apr_uid_get ( &i, &g, user, r->pool ); - ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i); - -//////// -/* Retrieve PW from /etc/passwd */ -/* Should include */ - struct passwd *pw; - if((pw = getpwnam(user)) == NULL) - { - ap_rprintf(r, "NULL \n
"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - else - { - ap_rprintf(r, "Unix PW : %s \n
", pw->pw_passwd); - } - -//////// -/* Retrieve PW from /etc/shadow */ -/* Should include */ - struct spwd *spw; - errno = 0; - if((spw = getspnam(user)) == NULL) - { - ap_rprintf(r, "NULL %d\n
", errno); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - else - { - ap_rprintf(r, "Shadow PW : %s \n
", spw->sp_pwdp); - } - - if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') { - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - -//////// -/* Encrypt and compare shadow password */ - -// TODO : Valider qu'on a un user -// TODO : Valider qu'il y a un password (pas * ! rien) - char *encrypted; - const char *correct; - int rrr; - encrypted = crypt(pass, spw->sp_pwdp); - rrr = strcmp(encrypted, spw->sp_pwdp); - ap_rprintf(r, "compare pw : %s \n
", encrypted);; - ap_rprintf(r, "compare : %d \n
", rrr); - if (rrr!=0) { - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - - - // If file is user readable and user match return content - if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) { - ap_rprintf(r, "Fichier propriétaire
\r\n"); - return (DECLINED); - } - - // If file is group readable and primary group match return content - if ((fperm.st_gid==g) && (fperm.st_mode & 0070 & permmask)) { - ap_rprintf(r, "Fichier groupe
\r\n"); - return (DECLINED); - } - - // now check supplemental groups - //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400); - gid_t grouplist[16]; - int grouplistsize = 16; - int *groupreturn; - groupreturn = getgrouplist("jlcyr", g, grouplist, &grouplistsize); - if (groupreturn != -1) { - ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize); - for (i=0; i\r\n"); - return (DECLINED); - } - } - } else { - ap_rprintf(r, "Erreur
\r\n"); - return OK; - } - - // else decline - ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - return OK; - -} - -//////////////////////////////////////////////////////////////// -static void absec_register_hooks(apr_pool_t *p) -{ - //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE); - ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST); - ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST); -} - -//////////////////////////////////////////////////////////////// -/* Dispatch list for API hooks */ -module AP_MODULE_DECLARE_DATA absec_module = { - STANDARD20_MODULE_STUFF, - NULL, /* create per-dir config structures */ - NULL, /* merge per-dir config structures */ - NULL, /* create per-server config structures */ - NULL, /* merge per-server config structures */ - NULL, /* table of config file commands */ - absec_register_hooks /* register hooks */ -}; - diff --git a/mod_absec_c.c b/mod_absec_c.c deleted file mode 100644 index cccb0f7..0000000 --- a/mod_absec_c.c +++ /dev/null @@ -1,388 +0,0 @@ -/* -** mod_absec.c -- Apache absec module -** [base Autogenerated via ``apxs -n absec -g''] -** -** To play with this sample module first compile it into a -** DSO file and install it into Apache's modules directory -** by running: -** -** $ apxs -lpam -lpam_misc -c -i mod_absec.c -** -** Then activate it in Apache's httpd.conf file for instance -** for the URL /absec in as follows: -** -** # httpd.conf -** LoadModule absec_module modules/mod_absec.so -** -** SetHandler absec -** -** -** Then after restarting Apache via -** -** $ apachectl restart -** -*/ - -/* - TEST URL - http://10.211.55.15/absec/ - - INFORMATION SOURCES - - https://apr.apache.org/docs/apr/1.5/group__apr__strings.html - https://apr.apache.org/docs/apr-util/1.6/files.html - - https://httpd.apache.org/docs/2.4/developer/modguide.html - http://www.ziviani.net/2011/how-to-create-an-apache-module - - https://en.wikipedia.org/wiki/Basic_access_authentication - -*/ - -#include "httpd.h" -#include "http_config.h" -#include "http_core.h" -#include "http_protocol.h" -#include "ap_config.h" -#include "apr_base64.h" -#include "apr_strings.h" -#include "apr_portable.h" -#include "apr_user.h" - -#include -#include -#include -#include -#include "apr_want.h" - -#include -#include - -#include -#include - -#include - -//////////////////////////////////////////////////////////////// -/* Check user autentication against unix user/pass */ -static int check_autentication(request_rec *r) -{ - return 0; -} - -//////////////////////////////////////////////////////////////// -/* Check check file perms */ -static int check_autorization(request_rec *r) -{ - return 0; -} - -// Global var for passing fake response to PAM callback -struct pam_response *reply; - -//////////////////////////////////////////////////////////////// -// PAM response callback function -int converse(int n, const struct pam_message **msg, - struct pam_response **resp, void *data) -{ - // Return globally set response - *resp = reply; - return PAM_SUCCESS; -} - -//////////////////////////////////////////////////////////////// -// define PAM callback function -struct pam_conv conv = { converse, 0 }; - -//////////////////////////////////////////////////////////////// -// define PAM callback function -int mysql_lookup(request_rec *r, struct stat *fperm) -{ - MYSQL *conn; - MYSQL_RES *res; - MYSQL_ROW row; - - char *server = "localhost"; - char *user = "jlcyr"; - char *password = "password"; /* set me first */ - char *database = "absec"; - - conn = mysql_init(NULL); - - /* Connect to database */ - if (!mysql_real_connect(conn, server, - user, password, database, 0, NULL, 0)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - - char query[256]; - sprintf(query, "select * from urls where url='%s'", r->uri); - /* send SQL query */ - //if (mysql_query(conn, "show tables")) { - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(-1); - } - - res = mysql_use_result(conn); - - /* output table name */ - ap_rprintf(r, "MySQL data:\n
"); - int cnt = 0; - while ((row = mysql_fetch_row(res)) != NULL) { - ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3])); - fperm->st_uid = atoi(row[1]); - fperm->st_gid = atoi(row[2]); - fperm->st_mode = atoi(row[3]); - cnt = cnt + 1; - } - - if (cnt==0) { - sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri); - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - ap_rprintf(r, "Aucune donnee\n
"); - } - - /* close connection */ - mysql_free_result(res); - mysql_close(conn); - return(0); -} - -//////////////////////////////////////////////////////////////// -/* Main routine - called after request processing */ -static int absec_handler_last(request_rec *r) -{ - // Is this module really called? - if (strcmp(r->handler, "absec")) { - return DECLINED; - } - - //////// - /* http method validate the perm asked (r/w vs get/post,put) */ - ap_rprintf(r, "After Method: %s
\r\n", r->method); - int permmask = 0; - if (strcmp(r->method,"GET")!=0) - { - // Not a GET, it's too late to do anything - ap_rprintf(r, "Not a GET post treatement is too late!\n
"); - return (DECLINED); - } - - r->content_type = "text/html"; - //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args); - ap_rprintf(r, "After GET Url: %s from %s \n
", r->filename, r->uri); - return (DECLINED); -} - -//////////////////////////////////////////////////////////////// -/* Main routine - called before request processing */ -static int absec_handler_first(request_rec *r) -{ - ap_rprintf(r, "Before Method: %s
\r\n", r->method); - // Is this module really called? - /*if (strcmp(r->handler, "absec")) { - ap_rprintf(r, "DECLINED
\r\n"); - return DECLINED; - }*/ - - - //////// - /* http method validate the perm asked (r/w vs get/post,put) */ - ap_rprintf(r, "Before Method: %s
\r\n", r->method); - - int permmask = 0; - if (strcmp(r->method,"GET")==0) permmask=0444; // r - if (strcmp(r->method,"PUT")==0) permmask=0222; // w - if (strcmp(r->method,"POST")==0) permmask=0222; // w - if (strcmp(r->method,"DELETE")==0) permmask=0111; // x - - //////// - /* check file permission on filesystem */ - /* should include */ - struct stat fperm; - int status; - //status = stat(r->filename, &fperm); - status = mysql_lookup(r, &fperm); - //ap_rprintf(r, "Result mysql: %d
\r\n", ); - if (status==-1) { - ap_rprintf(r, "stat erreur %d", errno); - return (OK); - } - //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status); - - /* check if any permission (ogw) match method (get r, put/post w, delete x) */ - if ((fperm.st_mode & permmask)==0) { - /* no permission match, return don't even have to check user perms */ - ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask); - return (OK); - } - - // If file is world accessible for asked method return content - if (fperm.st_mode & 0x7 & permmask) { - /* if so, return, no need to check user perms */ - //ap_rprintf(r, "Fichier public
\r\n"); - return (DECLINED); - } - - //////// - /* Check if we have a basic auth user */ - const char* auth64p; - // Check if we have an auth header - auth64p = apr_table_get(r->headers_in,"Authorization"); - - // If no basic auth, ask for one - if (auth64p==NULL) { - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"PAS DE USER ", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - - //////// - /* Retrieve user/pass from http basic auth header */ - // Get the basic auth base64 string and decode it - // Start at char 6 to skip 'Basic ' - char *auth64; - auth64 = apr_pstrdup(r->pool, auth64p+6); - char *auth; - auth = apr_pcalloc(r->pool, 64); - apr_base64_decode(auth, auth64); - char *user; - char *pass; - user = apr_strtok(auth, ":", &pass); - - r->content_type = "text/html"; - ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri); - //ap_rprintf(r, "Headers Authorization: %s \n
", auth64); - //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass); - - //////// - // Connect to PAM to auth user - pam_handle_t * pamh = NULL; - int rret; - - if((rret = pam_start("httpd", user/*pw->pw_name*/, &conv, &pamh)) != PAM_SUCCESS) { - return HTTP_INTERNAL_SERVER_ERROR; - printf("Pam start failed\n"); - exit(0); - } - - // Set the PAM callback function response (would call for password) - reply = (struct pam_response *)malloc(sizeof(struct pam_response)); - reply[0].resp = strdup(pass); // password received in basic auth - reply[0].resp_retcode = 0; - - if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) { - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"USER/PASS INVALIDE ", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - printf("User auth failed\n"); - exit(0); - } - - if(pam_end(pamh, rret) != PAM_SUCCESS) { - //perror("pam_end"); - pamh = NULL; - return HTTP_INTERNAL_SERVER_ERROR; - exit(1); - } - - //////// - // Continue checking permission - - //////// - /* Retrieve user details from /etc/passwd to get uid and primary group */ - /* Should include */ - struct passwd *pw; - if((pw = getpwnam(user)) == NULL) - { - // Should never happend as already verified with PAM - ap_rprintf(r, "NULL \n
"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r), - "\"", NULL)); - // User cannot be found, unauthorized - return HTTP_UNAUTHORIZED; - } - - // If file is user readable and user match return content - if ((fperm.st_uid==pw->pw_uid) && (fperm.st_mode & 0700 & permmask)) { - ap_rprintf(r, "Fichier propriétaire
\r\n"); - return (DECLINED); - } - - // If file is group readable and primary group match return content - if ((fperm.st_gid==pw->pw_gid) && (fperm.st_mode & 0070 & permmask)) { - ap_rprintf(r, "Fichier groupe
\r\n"); - return (DECLINED); - } - - //////// - /* Check supplemental groups */ - /* Should include */ - //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400); - gid_t grouplist[16]; - int grouplistsize = 16; - int groupreturn; - groupreturn = getgrouplist(user, pw->pw_gid, grouplist, &grouplistsize); - if (groupreturn >= 0) { - ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize); - for (int i=0; i\r\n"); - return (DECLINED); - } - } - } - - // else decline request - ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"NON AUTHORISE", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - -} - -//////////////////////////////////////////////////////////////// -static void absec_register_hooks(apr_pool_t *p) -{ - //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE); - ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST); - ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST); - - // should use HOOK FIXUP - - // should use FILTER -} - -//////////////////////////////////////////////////////////////// -/* Dispatch list for API hooks */ -module AP_MODULE_DECLARE_DATA absec_module = { - STANDARD20_MODULE_STUFF, - NULL, /* create per-dir config structures */ - NULL, /* merge per-dir config structures */ - NULL, /* create per-server config structures */ - NULL, /* merge per-server config structures */ - NULL, /* table of config file commands */ - absec_register_hooks /* register hooks */ -}; - diff --git a/mod_absec_d.c b/mod_absec_d.c deleted file mode 100644 index cccb0f7..0000000 --- a/mod_absec_d.c +++ /dev/null @@ -1,388 +0,0 @@ -/* -** mod_absec.c -- Apache absec module -** [base Autogenerated via ``apxs -n absec -g''] -** -** To play with this sample module first compile it into a -** DSO file and install it into Apache's modules directory -** by running: -** -** $ apxs -lpam -lpam_misc -c -i mod_absec.c -** -** Then activate it in Apache's httpd.conf file for instance -** for the URL /absec in as follows: -** -** # httpd.conf -** LoadModule absec_module modules/mod_absec.so -** -** SetHandler absec -** -** -** Then after restarting Apache via -** -** $ apachectl restart -** -*/ - -/* - TEST URL - http://10.211.55.15/absec/ - - INFORMATION SOURCES - - https://apr.apache.org/docs/apr/1.5/group__apr__strings.html - https://apr.apache.org/docs/apr-util/1.6/files.html - - https://httpd.apache.org/docs/2.4/developer/modguide.html - http://www.ziviani.net/2011/how-to-create-an-apache-module - - https://en.wikipedia.org/wiki/Basic_access_authentication - -*/ - -#include "httpd.h" -#include "http_config.h" -#include "http_core.h" -#include "http_protocol.h" -#include "ap_config.h" -#include "apr_base64.h" -#include "apr_strings.h" -#include "apr_portable.h" -#include "apr_user.h" - -#include -#include -#include -#include -#include "apr_want.h" - -#include -#include - -#include -#include - -#include - -//////////////////////////////////////////////////////////////// -/* Check user autentication against unix user/pass */ -static int check_autentication(request_rec *r) -{ - return 0; -} - -//////////////////////////////////////////////////////////////// -/* Check check file perms */ -static int check_autorization(request_rec *r) -{ - return 0; -} - -// Global var for passing fake response to PAM callback -struct pam_response *reply; - -//////////////////////////////////////////////////////////////// -// PAM response callback function -int converse(int n, const struct pam_message **msg, - struct pam_response **resp, void *data) -{ - // Return globally set response - *resp = reply; - return PAM_SUCCESS; -} - -//////////////////////////////////////////////////////////////// -// define PAM callback function -struct pam_conv conv = { converse, 0 }; - -//////////////////////////////////////////////////////////////// -// define PAM callback function -int mysql_lookup(request_rec *r, struct stat *fperm) -{ - MYSQL *conn; - MYSQL_RES *res; - MYSQL_ROW row; - - char *server = "localhost"; - char *user = "jlcyr"; - char *password = "password"; /* set me first */ - char *database = "absec"; - - conn = mysql_init(NULL); - - /* Connect to database */ - if (!mysql_real_connect(conn, server, - user, password, database, 0, NULL, 0)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - - char query[256]; - sprintf(query, "select * from urls where url='%s'", r->uri); - /* send SQL query */ - //if (mysql_query(conn, "show tables")) { - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(-1); - } - - res = mysql_use_result(conn); - - /* output table name */ - ap_rprintf(r, "MySQL data:\n
"); - int cnt = 0; - while ((row = mysql_fetch_row(res)) != NULL) { - ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3])); - fperm->st_uid = atoi(row[1]); - fperm->st_gid = atoi(row[2]); - fperm->st_mode = atoi(row[3]); - cnt = cnt + 1; - } - - if (cnt==0) { - sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri); - if (mysql_query(conn, query)) { - ap_rprintf(r, "%s\n
", mysql_error(conn)); - return(0); - } - ap_rprintf(r, "Aucune donnee\n
"); - } - - /* close connection */ - mysql_free_result(res); - mysql_close(conn); - return(0); -} - -//////////////////////////////////////////////////////////////// -/* Main routine - called after request processing */ -static int absec_handler_last(request_rec *r) -{ - // Is this module really called? - if (strcmp(r->handler, "absec")) { - return DECLINED; - } - - //////// - /* http method validate the perm asked (r/w vs get/post,put) */ - ap_rprintf(r, "After Method: %s
\r\n", r->method); - int permmask = 0; - if (strcmp(r->method,"GET")!=0) - { - // Not a GET, it's too late to do anything - ap_rprintf(r, "Not a GET post treatement is too late!\n
"); - return (DECLINED); - } - - r->content_type = "text/html"; - //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args); - ap_rprintf(r, "After GET Url: %s from %s \n
", r->filename, r->uri); - return (DECLINED); -} - -//////////////////////////////////////////////////////////////// -/* Main routine - called before request processing */ -static int absec_handler_first(request_rec *r) -{ - ap_rprintf(r, "Before Method: %s
\r\n", r->method); - // Is this module really called? - /*if (strcmp(r->handler, "absec")) { - ap_rprintf(r, "DECLINED
\r\n"); - return DECLINED; - }*/ - - - //////// - /* http method validate the perm asked (r/w vs get/post,put) */ - ap_rprintf(r, "Before Method: %s
\r\n", r->method); - - int permmask = 0; - if (strcmp(r->method,"GET")==0) permmask=0444; // r - if (strcmp(r->method,"PUT")==0) permmask=0222; // w - if (strcmp(r->method,"POST")==0) permmask=0222; // w - if (strcmp(r->method,"DELETE")==0) permmask=0111; // x - - //////// - /* check file permission on filesystem */ - /* should include */ - struct stat fperm; - int status; - //status = stat(r->filename, &fperm); - status = mysql_lookup(r, &fperm); - //ap_rprintf(r, "Result mysql: %d
\r\n", ); - if (status==-1) { - ap_rprintf(r, "stat erreur %d", errno); - return (OK); - } - //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status); - - /* check if any permission (ogw) match method (get r, put/post w, delete x) */ - if ((fperm.st_mode & permmask)==0) { - /* no permission match, return don't even have to check user perms */ - ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask); - return (OK); - } - - // If file is world accessible for asked method return content - if (fperm.st_mode & 0x7 & permmask) { - /* if so, return, no need to check user perms */ - //ap_rprintf(r, "Fichier public
\r\n"); - return (DECLINED); - } - - //////// - /* Check if we have a basic auth user */ - const char* auth64p; - // Check if we have an auth header - auth64p = apr_table_get(r->headers_in,"Authorization"); - - // If no basic auth, ask for one - if (auth64p==NULL) { - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"PAS DE USER ", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - } - - //////// - /* Retrieve user/pass from http basic auth header */ - // Get the basic auth base64 string and decode it - // Start at char 6 to skip 'Basic ' - char *auth64; - auth64 = apr_pstrdup(r->pool, auth64p+6); - char *auth; - auth = apr_pcalloc(r->pool, 64); - apr_base64_decode(auth, auth64); - char *user; - char *pass; - user = apr_strtok(auth, ":", &pass); - - r->content_type = "text/html"; - ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri); - //ap_rprintf(r, "Headers Authorization: %s \n
", auth64); - //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass); - - //////// - // Connect to PAM to auth user - pam_handle_t * pamh = NULL; - int rret; - - if((rret = pam_start("httpd", user/*pw->pw_name*/, &conv, &pamh)) != PAM_SUCCESS) { - return HTTP_INTERNAL_SERVER_ERROR; - printf("Pam start failed\n"); - exit(0); - } - - // Set the PAM callback function response (would call for password) - reply = (struct pam_response *)malloc(sizeof(struct pam_response)); - reply[0].resp = strdup(pass); // password received in basic auth - reply[0].resp_retcode = 0; - - if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) { - r->content_type = "text/html"; - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"USER/PASS INVALIDE ", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - printf("User auth failed\n"); - exit(0); - } - - if(pam_end(pamh, rret) != PAM_SUCCESS) { - //perror("pam_end"); - pamh = NULL; - return HTTP_INTERNAL_SERVER_ERROR; - exit(1); - } - - //////// - // Continue checking permission - - //////// - /* Retrieve user details from /etc/passwd to get uid and primary group */ - /* Should include */ - struct passwd *pw; - if((pw = getpwnam(user)) == NULL) - { - // Should never happend as already verified with PAM - ap_rprintf(r, "NULL \n
"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r), - "\"", NULL)); - // User cannot be found, unauthorized - return HTTP_UNAUTHORIZED; - } - - // If file is user readable and user match return content - if ((fperm.st_uid==pw->pw_uid) && (fperm.st_mode & 0700 & permmask)) { - ap_rprintf(r, "Fichier propriétaire
\r\n"); - return (DECLINED); - } - - // If file is group readable and primary group match return content - if ((fperm.st_gid==pw->pw_gid) && (fperm.st_mode & 0070 & permmask)) { - ap_rprintf(r, "Fichier groupe
\r\n"); - return (DECLINED); - } - - //////// - /* Check supplemental groups */ - /* Should include */ - //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400); - gid_t grouplist[16]; - int grouplistsize = 16; - int groupreturn; - groupreturn = getgrouplist(user, pw->pw_gid, grouplist, &grouplistsize); - if (groupreturn >= 0) { - ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize); - for (int i=0; i\r\n"); - return (DECLINED); - } - } - } - - // else decline request - ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n"); - apr_table_setn(r->err_headers_out, - (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate" - : "WWW-Authenticate", - apr_pstrcat(r->pool, "Basic realm=\"NON AUTHORISE", ap_auth_name(r), - "\"", NULL)); - return HTTP_UNAUTHORIZED; - -} - -//////////////////////////////////////////////////////////////// -static void absec_register_hooks(apr_pool_t *p) -{ - //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE); - ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST); - ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST); - - // should use HOOK FIXUP - - // should use FILTER -} - -//////////////////////////////////////////////////////////////// -/* Dispatch list for API hooks */ -module AP_MODULE_DECLARE_DATA absec_module = { - STANDARD20_MODULE_STUFF, - NULL, /* create per-dir config structures */ - NULL, /* merge per-dir config structures */ - NULL, /* create per-server config structures */ - NULL, /* merge per-server config structures */ - NULL, /* table of config file commands */ - absec_register_hooks /* register hooks */ -}; -