diff --git a/mod_absec_a.c b/mod_absec_a.c
deleted file mode 100644
index d43e184..0000000
--- a/mod_absec_a.c
+++ /dev/null
@@ -1,378 +0,0 @@
-/*
-** mod_absec.c -- Apache sample absec module
-** [Autogenerated via ``apxs -n absec -g'']
-**
-** To play with this sample module first compile it into a
-** DSO file and install it into Apache's modules directory
-** by running:
-**
-** $ apxs -c -i mod_absec.c
-**
-** Then activate it in Apache's httpd.conf file for instance
-** for the URL /absec in as follows:
-**
-** # httpd.conf
-** LoadModule absec_module modules/mod_absec.so
-**
-** SetHandler absec
-**
-**
-** Then after restarting Apache via
-**
-** $ apachectl restart
-**
-*/
-
-/*
- TEST URL
- http://10.211.55.15/absec?joe=blow
-
- INFORMATION SOURCES
-
- https://apr.apache.org/docs/apr/1.5/group__apr__strings.html
- https://apr.apache.org/docs/apr-util/1.6/files.html
-
- https://httpd.apache.org/docs/2.4/developer/modguide.html
- http://www.ziviani.net/2011/how-to-create-an-apache-module
-
- https://en.wikipedia.org/wiki/Basic_access_authentication
-
-*/
-
-#include "httpd.h"
-#include "http_config.h"
-#include "http_core.h"
-#include "http_protocol.h"
-#include "ap_config.h"
-#include "apr_base64.h"
-#include "apr_strings.h"
-#include "apr_portable.h"
-#include "apr_user.h"
-
-#include
-#include
-#include
-#include
-#include "apr_want.h"
-
-#include
-#include
-
-#include
-
-////////////////////////////////////////////////////////////////
-/* Check user autentication against unix user/pass */
-static int check_autentication(request_rec *r)
-{
- return 0;
-}
-
-////////////////////////////////////////////////////////////////
-/* Check check file perms */
-static int check_autorization(request_rec *r)
-{
- return 0;
-}
-
-////////////////////////////////////////////////////////////////
-// define PAM callback function
-int mysql_lookup(request_rec *r, struct stat *fperm)
-{
- MYSQL *conn;
- MYSQL_RES *res;
- MYSQL_ROW row;
-
- char *server = "localhost";
- char *user = "jlcyr";
- char *password = "password"; /* set me first */
- char *database = "absec";
-
- conn = mysql_init(NULL);
-
- /* Connect to database */
- if (!mysql_real_connect(conn, server,
- user, password, database, 0, NULL, 0)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
-
- char query[256];
- sprintf(query, "select * from urls where url='%s'", r->uri);
- /* send SQL query */
- //if (mysql_query(conn, "show tables")) {
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(-1);
- }
-
- res = mysql_use_result(conn);
-
- /* output table name */
- ap_rprintf(r, "MySQL data:\n
");
- int cnt = 0;
- while ((row = mysql_fetch_row(res)) != NULL) {
- ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3]));
- fperm->st_uid = atoi(row[1]);
- fperm->st_gid = atoi(row[2]);
- fperm->st_mode = atoi(row[3]);
- cnt = cnt + 1;
- }
-
- if (cnt==0) {
- sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri);
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
- ap_rprintf(r, "Aucune donnee\n
");
- }
-
- /* close connection */
- mysql_free_result(res);
- mysql_close(conn);
- return(0);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine */
-static int absec_handler_last(request_rec *r)
-{
- // Is this module really called?
- if (strcmp(r->handler, "absec")) {
- return DECLINED;
- }
- r->content_type = "text/html";
- //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args);
- ap_rprintf(r, "After Url: %s from %s \n
", r->filename, r->uri);
- return (OK);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine */
-static int absec_handler_first(request_rec *r)
-{
- // Is this module really called?
- if (strcmp(r->handler, "absec")) {
- return DECLINED;
- }
-
-////////
-/* http method validate the perm asked (r/w vs get/post,put) */
- ap_rprintf(r, "Method: %s
\r\n", r->method);
- int permmask = 0;
- if (strcmp(r->method,"GET")==0) permmask=0444; // r
- if (strcmp(r->method,"PUT")==0) permmask=0222; // w
- if (strcmp(r->method,"POST")==0) permmask=0222; // w
- if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
-
-////////
-/* check file permission on filesystem */
-/* should include */
- struct stat fperm;
- int status;
- //status = stat(r->filename, &fperm);
- status = mysql_lookup(r, &fperm);
- //ap_rprintf(r, "Result mysql: %d
\r\n", );
- if (status==-1) {
- ap_rprintf(r, "stat erreur %d", errno);
- return (OK);
- }
- //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
-
- /* check if any permission (ogw) match method (get r, put/post w, delete x) */
- if ((fperm.st_mode & permmask)==0) {
- /* no permission match, return don't even have to check user perms */
- //ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask);
- return (OK);
- }
-
- // If file is world accessible for asked method return content
- // TODO : if put/post/delete, must check BEFORE ACTION not AFTER!!!
- if (fperm.st_mode & 0x7 & permmask) {
- /* if so, return, no need to check user perms */
- //ap_rprintf(r, "Fichier public
\r\n");
- return (DECLINED);
- }
-
-////////
-/* Check if we have a basic auth user */
- const char* auth64p;
- // Check if we have an auth header
- auth64p = apr_table_get(r->headers_in,"Authorization");
-
- // If no basic auth, ask for one
- if (auth64p==NULL) {
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
-////////
-/* Retrieve user/pass from http basic auth header */
- // Get the basic auth base64 string and decode it
- // Start at char 6 to skip 'Basic '
- char *auth64;
- auth64 = apr_pstrdup(r->pool, auth64p+6);
- char *auth;
- auth = apr_pcalloc(r->pool, 64);
- apr_base64_decode(auth, auth64);
-
- // Validate user/pass against unix cred
- char *user;
- char *pass;
- user = apr_strtok(auth, ":", &pass);
-
- r->content_type = "text/html";
- //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args);
- ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri);
- //ap_rprintf(r, "Headers Authorization: %s \n
", auth64);
- //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass);
-
-////////
-// Get UID, GIDs for the user
-/* Working example, but just UID not PW */
- apr_status_t ret;
- apr_uid_t i;
- apr_gid_t g;
- ret = apr_uid_get ( &i, &g, user, r->pool );
- ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i);
-
-////////
-/* Retrieve PW from /etc/passwd */
-/* Should include */
- struct passwd *pw;
- if((pw = getpwnam(user)) == NULL)
- {
- ap_rprintf(r, "NULL \n
");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
- else
- {
- ap_rprintf(r, "Unix PW : %s \n
", pw->pw_passwd);
- }
-
-////////
-/* Retrieve PW from /etc/shadow */
-/* Should include */
- struct spwd *spw;
- errno = 0;
- if((spw = getspnam(user)) == NULL)
- {
- ap_rprintf(r, "NULL %d\n
", errno);
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
- else
- {
- ap_rprintf(r, "Shadow PW : %s \n
", spw->sp_pwdp);
- }
-
- if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') {
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
-////////
-/* Encrypt and compare shadow password */
-
-// TODO : Valider qu'on a un user
-// TODO : Valider qu'il y a un password (pas * ! rien)
- char *encrypted;
- const char *correct;
- int rrr;
- encrypted = crypt(pass, spw->sp_pwdp);
- rrr = strcmp(encrypted, spw->sp_pwdp);
- ap_rprintf(r, "compare pw : %s \n
", encrypted);;
- ap_rprintf(r, "compare : %d \n
", rrr);
- if (rrr!=0) {
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
-
- // If file is user readable and user match return content
- if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) {
- ap_rprintf(r, "Fichier propriétaire
\r\n");
- return (DECLINED);
- }
-
- // If file is group readable and primary group match return content
- if ((fperm.st_gid==g) && (fperm.st_mode & 0070 & permmask)) {
- ap_rprintf(r, "Fichier groupe
\r\n");
- return (DECLINED);
- }
-
- // now check supplemental groups
- //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
- gid_t grouplist[16];
- int grouplistsize = 16;
- int *groupreturn;
- groupreturn = getgrouplist("jlcyr", g, grouplist, &grouplistsize);
- if (groupreturn != -1) {
- ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize);
- for (i=0; i\r\n");
- return (DECLINED);
- }
- }
- } else {
- ap_rprintf(r, "Erreur
\r\n");
- return OK;
- }
-
- // else decline
- ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- return OK;
-
-}
-
-////////////////////////////////////////////////////////////////
-static void absec_register_hooks(apr_pool_t *p)
-{
- //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
- ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST);
- ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST);
-}
-
-////////////////////////////////////////////////////////////////
-/* Dispatch list for API hooks */
-module AP_MODULE_DECLARE_DATA absec_module = {
- STANDARD20_MODULE_STUFF,
- NULL, /* create per-dir config structures */
- NULL, /* merge per-dir config structures */
- NULL, /* create per-server config structures */
- NULL, /* merge per-server config structures */
- NULL, /* table of config file commands */
- absec_register_hooks /* register hooks */
-};
-
diff --git a/mod_absec_b.c b/mod_absec_b.c
deleted file mode 100644
index d43e184..0000000
--- a/mod_absec_b.c
+++ /dev/null
@@ -1,378 +0,0 @@
-/*
-** mod_absec.c -- Apache sample absec module
-** [Autogenerated via ``apxs -n absec -g'']
-**
-** To play with this sample module first compile it into a
-** DSO file and install it into Apache's modules directory
-** by running:
-**
-** $ apxs -c -i mod_absec.c
-**
-** Then activate it in Apache's httpd.conf file for instance
-** for the URL /absec in as follows:
-**
-** # httpd.conf
-** LoadModule absec_module modules/mod_absec.so
-**
-** SetHandler absec
-**
-**
-** Then after restarting Apache via
-**
-** $ apachectl restart
-**
-*/
-
-/*
- TEST URL
- http://10.211.55.15/absec?joe=blow
-
- INFORMATION SOURCES
-
- https://apr.apache.org/docs/apr/1.5/group__apr__strings.html
- https://apr.apache.org/docs/apr-util/1.6/files.html
-
- https://httpd.apache.org/docs/2.4/developer/modguide.html
- http://www.ziviani.net/2011/how-to-create-an-apache-module
-
- https://en.wikipedia.org/wiki/Basic_access_authentication
-
-*/
-
-#include "httpd.h"
-#include "http_config.h"
-#include "http_core.h"
-#include "http_protocol.h"
-#include "ap_config.h"
-#include "apr_base64.h"
-#include "apr_strings.h"
-#include "apr_portable.h"
-#include "apr_user.h"
-
-#include
-#include
-#include
-#include
-#include "apr_want.h"
-
-#include
-#include
-
-#include
-
-////////////////////////////////////////////////////////////////
-/* Check user autentication against unix user/pass */
-static int check_autentication(request_rec *r)
-{
- return 0;
-}
-
-////////////////////////////////////////////////////////////////
-/* Check check file perms */
-static int check_autorization(request_rec *r)
-{
- return 0;
-}
-
-////////////////////////////////////////////////////////////////
-// define PAM callback function
-int mysql_lookup(request_rec *r, struct stat *fperm)
-{
- MYSQL *conn;
- MYSQL_RES *res;
- MYSQL_ROW row;
-
- char *server = "localhost";
- char *user = "jlcyr";
- char *password = "password"; /* set me first */
- char *database = "absec";
-
- conn = mysql_init(NULL);
-
- /* Connect to database */
- if (!mysql_real_connect(conn, server,
- user, password, database, 0, NULL, 0)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
-
- char query[256];
- sprintf(query, "select * from urls where url='%s'", r->uri);
- /* send SQL query */
- //if (mysql_query(conn, "show tables")) {
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(-1);
- }
-
- res = mysql_use_result(conn);
-
- /* output table name */
- ap_rprintf(r, "MySQL data:\n
");
- int cnt = 0;
- while ((row = mysql_fetch_row(res)) != NULL) {
- ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3]));
- fperm->st_uid = atoi(row[1]);
- fperm->st_gid = atoi(row[2]);
- fperm->st_mode = atoi(row[3]);
- cnt = cnt + 1;
- }
-
- if (cnt==0) {
- sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri);
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
- ap_rprintf(r, "Aucune donnee\n
");
- }
-
- /* close connection */
- mysql_free_result(res);
- mysql_close(conn);
- return(0);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine */
-static int absec_handler_last(request_rec *r)
-{
- // Is this module really called?
- if (strcmp(r->handler, "absec")) {
- return DECLINED;
- }
- r->content_type = "text/html";
- //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args);
- ap_rprintf(r, "After Url: %s from %s \n
", r->filename, r->uri);
- return (OK);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine */
-static int absec_handler_first(request_rec *r)
-{
- // Is this module really called?
- if (strcmp(r->handler, "absec")) {
- return DECLINED;
- }
-
-////////
-/* http method validate the perm asked (r/w vs get/post,put) */
- ap_rprintf(r, "Method: %s
\r\n", r->method);
- int permmask = 0;
- if (strcmp(r->method,"GET")==0) permmask=0444; // r
- if (strcmp(r->method,"PUT")==0) permmask=0222; // w
- if (strcmp(r->method,"POST")==0) permmask=0222; // w
- if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
-
-////////
-/* check file permission on filesystem */
-/* should include */
- struct stat fperm;
- int status;
- //status = stat(r->filename, &fperm);
- status = mysql_lookup(r, &fperm);
- //ap_rprintf(r, "Result mysql: %d
\r\n", );
- if (status==-1) {
- ap_rprintf(r, "stat erreur %d", errno);
- return (OK);
- }
- //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
-
- /* check if any permission (ogw) match method (get r, put/post w, delete x) */
- if ((fperm.st_mode & permmask)==0) {
- /* no permission match, return don't even have to check user perms */
- //ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask);
- return (OK);
- }
-
- // If file is world accessible for asked method return content
- // TODO : if put/post/delete, must check BEFORE ACTION not AFTER!!!
- if (fperm.st_mode & 0x7 & permmask) {
- /* if so, return, no need to check user perms */
- //ap_rprintf(r, "Fichier public
\r\n");
- return (DECLINED);
- }
-
-////////
-/* Check if we have a basic auth user */
- const char* auth64p;
- // Check if we have an auth header
- auth64p = apr_table_get(r->headers_in,"Authorization");
-
- // If no basic auth, ask for one
- if (auth64p==NULL) {
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
-////////
-/* Retrieve user/pass from http basic auth header */
- // Get the basic auth base64 string and decode it
- // Start at char 6 to skip 'Basic '
- char *auth64;
- auth64 = apr_pstrdup(r->pool, auth64p+6);
- char *auth;
- auth = apr_pcalloc(r->pool, 64);
- apr_base64_decode(auth, auth64);
-
- // Validate user/pass against unix cred
- char *user;
- char *pass;
- user = apr_strtok(auth, ":", &pass);
-
- r->content_type = "text/html";
- //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args);
- ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri);
- //ap_rprintf(r, "Headers Authorization: %s \n
", auth64);
- //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass);
-
-////////
-// Get UID, GIDs for the user
-/* Working example, but just UID not PW */
- apr_status_t ret;
- apr_uid_t i;
- apr_gid_t g;
- ret = apr_uid_get ( &i, &g, user, r->pool );
- ap_rprintf(r, "Result2: G:%d, I:%d \n
", g,i);
-
-////////
-/* Retrieve PW from /etc/passwd */
-/* Should include */
- struct passwd *pw;
- if((pw = getpwnam(user)) == NULL)
- {
- ap_rprintf(r, "NULL \n
");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
- else
- {
- ap_rprintf(r, "Unix PW : %s \n
", pw->pw_passwd);
- }
-
-////////
-/* Retrieve PW from /etc/shadow */
-/* Should include */
- struct spwd *spw;
- errno = 0;
- if((spw = getspnam(user)) == NULL)
- {
- ap_rprintf(r, "NULL %d\n
", errno);
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
- else
- {
- ap_rprintf(r, "Shadow PW : %s \n
", spw->sp_pwdp);
- }
-
- if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') {
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
-////////
-/* Encrypt and compare shadow password */
-
-// TODO : Valider qu'on a un user
-// TODO : Valider qu'il y a un password (pas * ! rien)
- char *encrypted;
- const char *correct;
- int rrr;
- encrypted = crypt(pass, spw->sp_pwdp);
- rrr = strcmp(encrypted, spw->sp_pwdp);
- ap_rprintf(r, "compare pw : %s \n
", encrypted);;
- ap_rprintf(r, "compare : %d \n
", rrr);
- if (rrr!=0) {
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
-
- // If file is user readable and user match return content
- if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) {
- ap_rprintf(r, "Fichier propriétaire
\r\n");
- return (DECLINED);
- }
-
- // If file is group readable and primary group match return content
- if ((fperm.st_gid==g) && (fperm.st_mode & 0070 & permmask)) {
- ap_rprintf(r, "Fichier groupe
\r\n");
- return (DECLINED);
- }
-
- // now check supplemental groups
- //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
- gid_t grouplist[16];
- int grouplistsize = 16;
- int *groupreturn;
- groupreturn = getgrouplist("jlcyr", g, grouplist, &grouplistsize);
- if (groupreturn != -1) {
- ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize);
- for (i=0; i\r\n");
- return (DECLINED);
- }
- }
- } else {
- ap_rprintf(r, "Erreur
\r\n");
- return OK;
- }
-
- // else decline
- ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- return OK;
-
-}
-
-////////////////////////////////////////////////////////////////
-static void absec_register_hooks(apr_pool_t *p)
-{
- //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
- ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST);
- ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST);
-}
-
-////////////////////////////////////////////////////////////////
-/* Dispatch list for API hooks */
-module AP_MODULE_DECLARE_DATA absec_module = {
- STANDARD20_MODULE_STUFF,
- NULL, /* create per-dir config structures */
- NULL, /* merge per-dir config structures */
- NULL, /* create per-server config structures */
- NULL, /* merge per-server config structures */
- NULL, /* table of config file commands */
- absec_register_hooks /* register hooks */
-};
-
diff --git a/mod_absec_c.c b/mod_absec_c.c
deleted file mode 100644
index cccb0f7..0000000
--- a/mod_absec_c.c
+++ /dev/null
@@ -1,388 +0,0 @@
-/*
-** mod_absec.c -- Apache absec module
-** [base Autogenerated via ``apxs -n absec -g'']
-**
-** To play with this sample module first compile it into a
-** DSO file and install it into Apache's modules directory
-** by running:
-**
-** $ apxs -lpam -lpam_misc -c -i mod_absec.c
-**
-** Then activate it in Apache's httpd.conf file for instance
-** for the URL /absec in as follows:
-**
-** # httpd.conf
-** LoadModule absec_module modules/mod_absec.so
-**
-** SetHandler absec
-**
-**
-** Then after restarting Apache via
-**
-** $ apachectl restart
-**
-*/
-
-/*
- TEST URL
- http://10.211.55.15/absec/
-
- INFORMATION SOURCES
-
- https://apr.apache.org/docs/apr/1.5/group__apr__strings.html
- https://apr.apache.org/docs/apr-util/1.6/files.html
-
- https://httpd.apache.org/docs/2.4/developer/modguide.html
- http://www.ziviani.net/2011/how-to-create-an-apache-module
-
- https://en.wikipedia.org/wiki/Basic_access_authentication
-
-*/
-
-#include "httpd.h"
-#include "http_config.h"
-#include "http_core.h"
-#include "http_protocol.h"
-#include "ap_config.h"
-#include "apr_base64.h"
-#include "apr_strings.h"
-#include "apr_portable.h"
-#include "apr_user.h"
-
-#include
-#include
-#include
-#include
-#include "apr_want.h"
-
-#include
-#include
-
-#include
-#include
-
-#include
-
-////////////////////////////////////////////////////////////////
-/* Check user autentication against unix user/pass */
-static int check_autentication(request_rec *r)
-{
- return 0;
-}
-
-////////////////////////////////////////////////////////////////
-/* Check check file perms */
-static int check_autorization(request_rec *r)
-{
- return 0;
-}
-
-// Global var for passing fake response to PAM callback
-struct pam_response *reply;
-
-////////////////////////////////////////////////////////////////
-// PAM response callback function
-int converse(int n, const struct pam_message **msg,
- struct pam_response **resp, void *data)
-{
- // Return globally set response
- *resp = reply;
- return PAM_SUCCESS;
-}
-
-////////////////////////////////////////////////////////////////
-// define PAM callback function
-struct pam_conv conv = { converse, 0 };
-
-////////////////////////////////////////////////////////////////
-// define PAM callback function
-int mysql_lookup(request_rec *r, struct stat *fperm)
-{
- MYSQL *conn;
- MYSQL_RES *res;
- MYSQL_ROW row;
-
- char *server = "localhost";
- char *user = "jlcyr";
- char *password = "password"; /* set me first */
- char *database = "absec";
-
- conn = mysql_init(NULL);
-
- /* Connect to database */
- if (!mysql_real_connect(conn, server,
- user, password, database, 0, NULL, 0)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
-
- char query[256];
- sprintf(query, "select * from urls where url='%s'", r->uri);
- /* send SQL query */
- //if (mysql_query(conn, "show tables")) {
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(-1);
- }
-
- res = mysql_use_result(conn);
-
- /* output table name */
- ap_rprintf(r, "MySQL data:\n
");
- int cnt = 0;
- while ((row = mysql_fetch_row(res)) != NULL) {
- ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3]));
- fperm->st_uid = atoi(row[1]);
- fperm->st_gid = atoi(row[2]);
- fperm->st_mode = atoi(row[3]);
- cnt = cnt + 1;
- }
-
- if (cnt==0) {
- sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri);
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
- ap_rprintf(r, "Aucune donnee\n
");
- }
-
- /* close connection */
- mysql_free_result(res);
- mysql_close(conn);
- return(0);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine - called after request processing */
-static int absec_handler_last(request_rec *r)
-{
- // Is this module really called?
- if (strcmp(r->handler, "absec")) {
- return DECLINED;
- }
-
- ////////
- /* http method validate the perm asked (r/w vs get/post,put) */
- ap_rprintf(r, "After Method: %s
\r\n", r->method);
- int permmask = 0;
- if (strcmp(r->method,"GET")!=0)
- {
- // Not a GET, it's too late to do anything
- ap_rprintf(r, "Not a GET post treatement is too late!\n
");
- return (DECLINED);
- }
-
- r->content_type = "text/html";
- //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args);
- ap_rprintf(r, "After GET Url: %s from %s \n
", r->filename, r->uri);
- return (DECLINED);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine - called before request processing */
-static int absec_handler_first(request_rec *r)
-{
- ap_rprintf(r, "Before Method: %s
\r\n", r->method);
- // Is this module really called?
- /*if (strcmp(r->handler, "absec")) {
- ap_rprintf(r, "DECLINED
\r\n");
- return DECLINED;
- }*/
-
-
- ////////
- /* http method validate the perm asked (r/w vs get/post,put) */
- ap_rprintf(r, "Before Method: %s
\r\n", r->method);
-
- int permmask = 0;
- if (strcmp(r->method,"GET")==0) permmask=0444; // r
- if (strcmp(r->method,"PUT")==0) permmask=0222; // w
- if (strcmp(r->method,"POST")==0) permmask=0222; // w
- if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
-
- ////////
- /* check file permission on filesystem */
- /* should include */
- struct stat fperm;
- int status;
- //status = stat(r->filename, &fperm);
- status = mysql_lookup(r, &fperm);
- //ap_rprintf(r, "Result mysql: %d
\r\n", );
- if (status==-1) {
- ap_rprintf(r, "stat erreur %d", errno);
- return (OK);
- }
- //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
-
- /* check if any permission (ogw) match method (get r, put/post w, delete x) */
- if ((fperm.st_mode & permmask)==0) {
- /* no permission match, return don't even have to check user perms */
- ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask);
- return (OK);
- }
-
- // If file is world accessible for asked method return content
- if (fperm.st_mode & 0x7 & permmask) {
- /* if so, return, no need to check user perms */
- //ap_rprintf(r, "Fichier public
\r\n");
- return (DECLINED);
- }
-
- ////////
- /* Check if we have a basic auth user */
- const char* auth64p;
- // Check if we have an auth header
- auth64p = apr_table_get(r->headers_in,"Authorization");
-
- // If no basic auth, ask for one
- if (auth64p==NULL) {
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"PAS DE USER ", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
- ////////
- /* Retrieve user/pass from http basic auth header */
- // Get the basic auth base64 string and decode it
- // Start at char 6 to skip 'Basic '
- char *auth64;
- auth64 = apr_pstrdup(r->pool, auth64p+6);
- char *auth;
- auth = apr_pcalloc(r->pool, 64);
- apr_base64_decode(auth, auth64);
- char *user;
- char *pass;
- user = apr_strtok(auth, ":", &pass);
-
- r->content_type = "text/html";
- ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri);
- //ap_rprintf(r, "Headers Authorization: %s \n
", auth64);
- //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass);
-
- ////////
- // Connect to PAM to auth user
- pam_handle_t * pamh = NULL;
- int rret;
-
- if((rret = pam_start("httpd", user/*pw->pw_name*/, &conv, &pamh)) != PAM_SUCCESS) {
- return HTTP_INTERNAL_SERVER_ERROR;
- printf("Pam start failed\n");
- exit(0);
- }
-
- // Set the PAM callback function response (would call for password)
- reply = (struct pam_response *)malloc(sizeof(struct pam_response));
- reply[0].resp = strdup(pass); // password received in basic auth
- reply[0].resp_retcode = 0;
-
- if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"USER/PASS INVALIDE ", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- printf("User auth failed\n");
- exit(0);
- }
-
- if(pam_end(pamh, rret) != PAM_SUCCESS) {
- //perror("pam_end");
- pamh = NULL;
- return HTTP_INTERNAL_SERVER_ERROR;
- exit(1);
- }
-
- ////////
- // Continue checking permission
-
- ////////
- /* Retrieve user details from /etc/passwd to get uid and primary group */
- /* Should include */
- struct passwd *pw;
- if((pw = getpwnam(user)) == NULL)
- {
- // Should never happend as already verified with PAM
- ap_rprintf(r, "NULL \n
");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r),
- "\"", NULL));
- // User cannot be found, unauthorized
- return HTTP_UNAUTHORIZED;
- }
-
- // If file is user readable and user match return content
- if ((fperm.st_uid==pw->pw_uid) && (fperm.st_mode & 0700 & permmask)) {
- ap_rprintf(r, "Fichier propriétaire
\r\n");
- return (DECLINED);
- }
-
- // If file is group readable and primary group match return content
- if ((fperm.st_gid==pw->pw_gid) && (fperm.st_mode & 0070 & permmask)) {
- ap_rprintf(r, "Fichier groupe
\r\n");
- return (DECLINED);
- }
-
- ////////
- /* Check supplemental groups */
- /* Should include */
- //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
- gid_t grouplist[16];
- int grouplistsize = 16;
- int groupreturn;
- groupreturn = getgrouplist(user, pw->pw_gid, grouplist, &grouplistsize);
- if (groupreturn >= 0) {
- ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize);
- for (int i=0; i\r\n");
- return (DECLINED);
- }
- }
- }
-
- // else decline request
- ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"NON AUTHORISE", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
-
-}
-
-////////////////////////////////////////////////////////////////
-static void absec_register_hooks(apr_pool_t *p)
-{
- //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
- ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST);
- ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST);
-
- // should use HOOK FIXUP
-
- // should use FILTER
-}
-
-////////////////////////////////////////////////////////////////
-/* Dispatch list for API hooks */
-module AP_MODULE_DECLARE_DATA absec_module = {
- STANDARD20_MODULE_STUFF,
- NULL, /* create per-dir config structures */
- NULL, /* merge per-dir config structures */
- NULL, /* create per-server config structures */
- NULL, /* merge per-server config structures */
- NULL, /* table of config file commands */
- absec_register_hooks /* register hooks */
-};
-
diff --git a/mod_absec_d.c b/mod_absec_d.c
deleted file mode 100644
index cccb0f7..0000000
--- a/mod_absec_d.c
+++ /dev/null
@@ -1,388 +0,0 @@
-/*
-** mod_absec.c -- Apache absec module
-** [base Autogenerated via ``apxs -n absec -g'']
-**
-** To play with this sample module first compile it into a
-** DSO file and install it into Apache's modules directory
-** by running:
-**
-** $ apxs -lpam -lpam_misc -c -i mod_absec.c
-**
-** Then activate it in Apache's httpd.conf file for instance
-** for the URL /absec in as follows:
-**
-** # httpd.conf
-** LoadModule absec_module modules/mod_absec.so
-**
-** SetHandler absec
-**
-**
-** Then after restarting Apache via
-**
-** $ apachectl restart
-**
-*/
-
-/*
- TEST URL
- http://10.211.55.15/absec/
-
- INFORMATION SOURCES
-
- https://apr.apache.org/docs/apr/1.5/group__apr__strings.html
- https://apr.apache.org/docs/apr-util/1.6/files.html
-
- https://httpd.apache.org/docs/2.4/developer/modguide.html
- http://www.ziviani.net/2011/how-to-create-an-apache-module
-
- https://en.wikipedia.org/wiki/Basic_access_authentication
-
-*/
-
-#include "httpd.h"
-#include "http_config.h"
-#include "http_core.h"
-#include "http_protocol.h"
-#include "ap_config.h"
-#include "apr_base64.h"
-#include "apr_strings.h"
-#include "apr_portable.h"
-#include "apr_user.h"
-
-#include
-#include
-#include
-#include
-#include "apr_want.h"
-
-#include
-#include
-
-#include
-#include
-
-#include
-
-////////////////////////////////////////////////////////////////
-/* Check user autentication against unix user/pass */
-static int check_autentication(request_rec *r)
-{
- return 0;
-}
-
-////////////////////////////////////////////////////////////////
-/* Check check file perms */
-static int check_autorization(request_rec *r)
-{
- return 0;
-}
-
-// Global var for passing fake response to PAM callback
-struct pam_response *reply;
-
-////////////////////////////////////////////////////////////////
-// PAM response callback function
-int converse(int n, const struct pam_message **msg,
- struct pam_response **resp, void *data)
-{
- // Return globally set response
- *resp = reply;
- return PAM_SUCCESS;
-}
-
-////////////////////////////////////////////////////////////////
-// define PAM callback function
-struct pam_conv conv = { converse, 0 };
-
-////////////////////////////////////////////////////////////////
-// define PAM callback function
-int mysql_lookup(request_rec *r, struct stat *fperm)
-{
- MYSQL *conn;
- MYSQL_RES *res;
- MYSQL_ROW row;
-
- char *server = "localhost";
- char *user = "jlcyr";
- char *password = "password"; /* set me first */
- char *database = "absec";
-
- conn = mysql_init(NULL);
-
- /* Connect to database */
- if (!mysql_real_connect(conn, server,
- user, password, database, 0, NULL, 0)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
-
- char query[256];
- sprintf(query, "select * from urls where url='%s'", r->uri);
- /* send SQL query */
- //if (mysql_query(conn, "show tables")) {
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(-1);
- }
-
- res = mysql_use_result(conn);
-
- /* output table name */
- ap_rprintf(r, "MySQL data:\n
");
- int cnt = 0;
- while ((row = mysql_fetch_row(res)) != NULL) {
- ap_rprintf(r, "%s %d %d %o \n
", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3]));
- fperm->st_uid = atoi(row[1]);
- fperm->st_gid = atoi(row[2]);
- fperm->st_mode = atoi(row[3]);
- cnt = cnt + 1;
- }
-
- if (cnt==0) {
- sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri);
- if (mysql_query(conn, query)) {
- ap_rprintf(r, "%s\n
", mysql_error(conn));
- return(0);
- }
- ap_rprintf(r, "Aucune donnee\n
");
- }
-
- /* close connection */
- mysql_free_result(res);
- mysql_close(conn);
- return(0);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine - called after request processing */
-static int absec_handler_last(request_rec *r)
-{
- // Is this module really called?
- if (strcmp(r->handler, "absec")) {
- return DECLINED;
- }
-
- ////////
- /* http method validate the perm asked (r/w vs get/post,put) */
- ap_rprintf(r, "After Method: %s
\r\n", r->method);
- int permmask = 0;
- if (strcmp(r->method,"GET")!=0)
- {
- // Not a GET, it's too late to do anything
- ap_rprintf(r, "Not a GET post treatement is too late!\n
");
- return (DECLINED);
- }
-
- r->content_type = "text/html";
- //ap_rprintf(r, "The sample page from mod_absec.c %s \n
", r->args);
- ap_rprintf(r, "After GET Url: %s from %s \n
", r->filename, r->uri);
- return (DECLINED);
-}
-
-////////////////////////////////////////////////////////////////
-/* Main routine - called before request processing */
-static int absec_handler_first(request_rec *r)
-{
- ap_rprintf(r, "Before Method: %s
\r\n", r->method);
- // Is this module really called?
- /*if (strcmp(r->handler, "absec")) {
- ap_rprintf(r, "DECLINED
\r\n");
- return DECLINED;
- }*/
-
-
- ////////
- /* http method validate the perm asked (r/w vs get/post,put) */
- ap_rprintf(r, "Before Method: %s
\r\n", r->method);
-
- int permmask = 0;
- if (strcmp(r->method,"GET")==0) permmask=0444; // r
- if (strcmp(r->method,"PUT")==0) permmask=0222; // w
- if (strcmp(r->method,"POST")==0) permmask=0222; // w
- if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
-
- ////////
- /* check file permission on filesystem */
- /* should include */
- struct stat fperm;
- int status;
- //status = stat(r->filename, &fperm);
- status = mysql_lookup(r, &fperm);
- //ap_rprintf(r, "Result mysql: %d
\r\n", );
- if (status==-1) {
- ap_rprintf(r, "stat erreur %d", errno);
- return (OK);
- }
- //ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)
\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
-
- /* check if any permission (ogw) match method (get r, put/post w, delete x) */
- if ((fperm.st_mode & permmask)==0) {
- /* no permission match, return don't even have to check user perms */
- ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask);
- return (OK);
- }
-
- // If file is world accessible for asked method return content
- if (fperm.st_mode & 0x7 & permmask) {
- /* if so, return, no need to check user perms */
- //ap_rprintf(r, "Fichier public
\r\n");
- return (DECLINED);
- }
-
- ////////
- /* Check if we have a basic auth user */
- const char* auth64p;
- // Check if we have an auth header
- auth64p = apr_table_get(r->headers_in,"Authorization");
-
- // If no basic auth, ask for one
- if (auth64p==NULL) {
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"PAS DE USER ", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- }
-
- ////////
- /* Retrieve user/pass from http basic auth header */
- // Get the basic auth base64 string and decode it
- // Start at char 6 to skip 'Basic '
- char *auth64;
- auth64 = apr_pstrdup(r->pool, auth64p+6);
- char *auth;
- auth = apr_pcalloc(r->pool, 64);
- apr_base64_decode(auth, auth64);
- char *user;
- char *pass;
- user = apr_strtok(auth, ":", &pass);
-
- r->content_type = "text/html";
- ap_rprintf(r, "Url: %s from %s \n
", r->filename, r->uri);
- //ap_rprintf(r, "Headers Authorization: %s \n
", auth64);
- //ap_rprintf(r, "User/Pass: %s/%s \n
", user, pass);
-
- ////////
- // Connect to PAM to auth user
- pam_handle_t * pamh = NULL;
- int rret;
-
- if((rret = pam_start("httpd", user/*pw->pw_name*/, &conv, &pamh)) != PAM_SUCCESS) {
- return HTTP_INTERNAL_SERVER_ERROR;
- printf("Pam start failed\n");
- exit(0);
- }
-
- // Set the PAM callback function response (would call for password)
- reply = (struct pam_response *)malloc(sizeof(struct pam_response));
- reply[0].resp = strdup(pass); // password received in basic auth
- reply[0].resp_retcode = 0;
-
- if((rret = pam_authenticate(pamh, 0)) != PAM_SUCCESS) {
- r->content_type = "text/html";
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"USER/PASS INVALIDE ", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
- printf("User auth failed\n");
- exit(0);
- }
-
- if(pam_end(pamh, rret) != PAM_SUCCESS) {
- //perror("pam_end");
- pamh = NULL;
- return HTTP_INTERNAL_SERVER_ERROR;
- exit(1);
- }
-
- ////////
- // Continue checking permission
-
- ////////
- /* Retrieve user details from /etc/passwd to get uid and primary group */
- /* Should include */
- struct passwd *pw;
- if((pw = getpwnam(user)) == NULL)
- {
- // Should never happend as already verified with PAM
- ap_rprintf(r, "NULL \n
");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"USER INCONNU ", ap_auth_name(r),
- "\"", NULL));
- // User cannot be found, unauthorized
- return HTTP_UNAUTHORIZED;
- }
-
- // If file is user readable and user match return content
- if ((fperm.st_uid==pw->pw_uid) && (fperm.st_mode & 0700 & permmask)) {
- ap_rprintf(r, "Fichier propriétaire
\r\n");
- return (DECLINED);
- }
-
- // If file is group readable and primary group match return content
- if ((fperm.st_gid==pw->pw_gid) && (fperm.st_mode & 0070 & permmask)) {
- ap_rprintf(r, "Fichier groupe
\r\n");
- return (DECLINED);
- }
-
- ////////
- /* Check supplemental groups */
- /* Should include */
- //ap_rprintf(r, "Fichier propriétaire %d %d %o %o
\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
- gid_t grouplist[16];
- int grouplistsize = 16;
- int groupreturn;
- groupreturn = getgrouplist(user, pw->pw_gid, grouplist, &grouplistsize);
- if (groupreturn >= 0) {
- ap_rprintf(r, "OK liste des groupes (%d)
\r\n", grouplistsize);
- for (int i=0; i\r\n");
- return (DECLINED);
- }
- }
- }
-
- // else decline request
- ap_rprintf(r, "Aucuns droits de voir le fichier
\r\n");
- apr_table_setn(r->err_headers_out,
- (PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
- : "WWW-Authenticate",
- apr_pstrcat(r->pool, "Basic realm=\"NON AUTHORISE", ap_auth_name(r),
- "\"", NULL));
- return HTTP_UNAUTHORIZED;
-
-}
-
-////////////////////////////////////////////////////////////////
-static void absec_register_hooks(apr_pool_t *p)
-{
- //ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
- ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST);
- ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST);
-
- // should use HOOK FIXUP
-
- // should use FILTER
-}
-
-////////////////////////////////////////////////////////////////
-/* Dispatch list for API hooks */
-module AP_MODULE_DECLARE_DATA absec_module = {
- STANDARD20_MODULE_STUFF,
- NULL, /* create per-dir config structures */
- NULL, /* merge per-dir config structures */
- NULL, /* create per-server config structures */
- NULL, /* merge per-server config structures */
- NULL, /* table of config file commands */
- absec_register_hooks /* register hooks */
-};
-