jlcyr/ABSEC
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

commit all files, will need cleanup later.

Browse Source
This commit is contained in:
Jean-Luc Cyr
2018-11-13 14:29:46 -05:00
parent dd1db50da1
commit ca90192f52
19 changed files with 2049 additions and 121 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mod_absec_a.c
+378
View File
@@ -0,0 +1,378 @@
/*
** mod_absec.c -- Apache sample absec module
** [Autogenerated via ``apxs -n absec -g'']
**
** To play with this sample module first compile it into a
** DSO file and install it into Apache's modules directory
** by running:
**
** $ apxs -c -i mod_absec.c
**
** Then activate it in Apache's httpd.conf file for instance
** for the URL /absec in as follows:
**
** # httpd.conf
** LoadModule absec_module modules/mod_absec.so
** <Location /absec>
** SetHandler absec
** </Location>
**
** Then after restarting Apache via
**
** $ apachectl restart
**
*/
/*
TEST URL
http://10.211.55.15/absec?joe=blow
INFORMATION SOURCES
https://apr.apache.org/docs/apr/1.5/group__apr__strings.html
https://apr.apache.org/docs/apr-util/1.6/files.html
https://httpd.apache.org/docs/2.4/developer/modguide.html
http://www.ziviani.net/2011/how-to-create-an-apache-module
https://en.wikipedia.org/wiki/Basic_access_authentication
*/
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_protocol.h"
#include "ap_config.h"
#include "apr_base64.h"
#include "apr_strings.h"
#include "apr_portable.h"
#include "apr_user.h"
#include <pwd.h>
#include <grp.h>
#include <sys/types.h>
#include <unistd.h>
#include "apr_want.h"
#include <shadow.h>
#include <sys/stat.h>
#include <mysql.h>
////////////////////////////////////////////////////////////////
/* Check user autentication against unix user/pass */
static int check_autentication(request_rec *r)
{
return 0;
}
////////////////////////////////////////////////////////////////
/* Check check file perms */
static int check_autorization(request_rec *r)
{
return 0;
}
////////////////////////////////////////////////////////////////
// define PAM callback function
int mysql_lookup(request_rec *r, struct stat *fperm)
{
MYSQL *conn;
MYSQL_RES *res;
MYSQL_ROW row;
char *server = "localhost";
char *user = "jlcyr";
char *password = "password"; /* set me first */
char *database = "absec";
conn = mysql_init(NULL);
/* Connect to database */
if (!mysql_real_connect(conn, server,
user, password, database, 0, NULL, 0)) {
ap_rprintf(r, "%s\n<br/>", mysql_error(conn));
return(0);
}
char query[256];
sprintf(query, "select * from urls where url='%s'", r->uri);
/* send SQL query */
//if (mysql_query(conn, "show tables")) {
if (mysql_query(conn, query)) {
ap_rprintf(r, "%s\n<br/>", mysql_error(conn));
return(-1);
}
res = mysql_use_result(conn);
/* output table name */
ap_rprintf(r, "MySQL data:\n<br/>");
int cnt = 0;
while ((row = mysql_fetch_row(res)) != NULL) {
ap_rprintf(r, "%s %d %d %o \n<br/>", row[0], atoi(row[1]), atoi(row[2]), atoi(row[3]));
fperm->st_uid = atoi(row[1]);
fperm->st_gid = atoi(row[2]);
fperm->st_mode = atoi(row[3]);
cnt = cnt + 1;
}
if (cnt==0) {
sprintf(query, "insert into urls (url, uid, gid, perms) values ('%s', 0, 0, 0)", r->uri);
if (mysql_query(conn, query)) {
ap_rprintf(r, "%s\n<br/>", mysql_error(conn));
return(0);
}
ap_rprintf(r, "Aucune donnee\n<br/>");
}
/* close connection */
mysql_free_result(res);
mysql_close(conn);
return(0);
}
////////////////////////////////////////////////////////////////
/* Main routine */
static int absec_handler_last(request_rec *r)
{
// Is this module really called?
if (strcmp(r->handler, "absec")) {
return DECLINED;
}
r->content_type = "text/html";
//ap_rprintf(r, "The sample page from mod_absec.c %s \n<br/>", r->args);
ap_rprintf(r, "After Url: %s from %s \n<br/>", r->filename, r->uri);
return (OK);
}
////////////////////////////////////////////////////////////////
/* Main routine */
static int absec_handler_first(request_rec *r)
{
// Is this module really called?
if (strcmp(r->handler, "absec")) {
return DECLINED;
}
////////
/* http method validate the perm asked (r/w vs get/post,put) */
ap_rprintf(r, "Method: %s<br/>\r\n", r->method);
int permmask = 0;
if (strcmp(r->method,"GET")==0) permmask=0444; // r
if (strcmp(r->method,"PUT")==0) permmask=0222; // w
if (strcmp(r->method,"POST")==0) permmask=0222; // w
if (strcmp(r->method,"DELETE")==0) permmask=0111; // x
////////
/* check file permission on filesystem */
/* should include <sys/stat.h> */
struct stat fperm;
int status;
//status = stat(r->filename, &fperm);
status = mysql_lookup(r, &fperm);
//ap_rprintf(r, "Result mysql: %d<br/>\r\n", );
if (status==-1) {
ap_rprintf(r, "stat erreur %d", errno);
return (OK);
}
//ap_rprintf(r, "File perms %o, owner %d, group %d (status %d)<br/>\r\n", fperm.st_mode, fperm.st_uid, fperm.st_gid, status);
/* check if any permission (ogw) match method (get r, put/post w, delete x) */
if ((fperm.st_mode & permmask)==0) {
/* no permission match, return don't even have to check user perms */
//ap_rprintf(r, "Aucune permission pour la methode %s (%o, %o)", r->method, fperm.st_mode, permmask);
return (OK);
}
// If file is world accessible for asked method return content
// TODO : if put/post/delete, must check BEFORE ACTION not AFTER!!!
if (fperm.st_mode & 0x7 & permmask) {
/* if so, return, no need to check user perms */
//ap_rprintf(r, "Fichier public<br/>\r\n");
return (DECLINED);
}
////////
/* Check if we have a basic auth user */
const char* auth64p;
// Check if we have an auth header
auth64p = apr_table_get(r->headers_in,"Authorization");
// If no basic auth, ask for one
if (auth64p==NULL) {
r->content_type = "text/html";
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
}
////////
/* Retrieve user/pass from http basic auth header */
// Get the basic auth base64 string and decode it
// Start at char 6 to skip 'Basic '
char *auth64;
auth64 = apr_pstrdup(r->pool, auth64p+6);
char *auth;
auth = apr_pcalloc(r->pool, 64);
apr_base64_decode(auth, auth64);
// Validate user/pass against unix cred
char *user;
char *pass;
user = apr_strtok(auth, ":", &pass);
r->content_type = "text/html";
//ap_rprintf(r, "The sample page from mod_absec.c %s \n<br/>", r->args);
ap_rprintf(r, "Url: %s from %s \n<br/>", r->filename, r->uri);
//ap_rprintf(r, "Headers Authorization: %s \n<br/>", auth64);
//ap_rprintf(r, "User/Pass: %s/%s \n<br/>", user, pass);
////////
// Get UID, GIDs for the user
/* Working example, but just UID not PW */
apr_status_t ret;
apr_uid_t i;
apr_gid_t g;
ret = apr_uid_get ( &i, &g, user, r->pool );
ap_rprintf(r, "Result2: G:%d, I:%d \n<br/>", g,i);
////////
/* Retrieve PW from /etc/passwd */
/* Should include <pwd.h> */
struct passwd *pw;
if((pw = getpwnam(user)) == NULL)
{
ap_rprintf(r, "NULL \n<br/>");
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
}
else
{
ap_rprintf(r, "Unix PW : %s \n<br/>", pw->pw_passwd);
}
////////
/* Retrieve PW from /etc/shadow */
/* Should include <shadow.h> */
struct spwd *spw;
errno = 0;
if((spw = getspnam(user)) == NULL)
{
ap_rprintf(r, "NULL %d\n<br/>", errno);
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
}
else
{
ap_rprintf(r, "Shadow PW : %s \n<br/>", spw->sp_pwdp);
}
if (spw->sp_pwdp[0] == 'x' || spw->sp_pwdp[0] == '*' || spw->sp_pwdp[0] == '!') {
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
}
////////
/* Encrypt and compare shadow password */
// TODO : Valider qu'on a un user
// TODO : Valider qu'il y a un password (pas * ! rien)
char *encrypted;
const char *correct;
int rrr;
encrypted = crypt(pass, spw->sp_pwdp);
rrr = strcmp(encrypted, spw->sp_pwdp);
ap_rprintf(r, "compare pw : %s \n<br/>", encrypted);;
ap_rprintf(r, "compare : %d \n<br/>", rrr);
if (rrr!=0) {
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
}
// If file is user readable and user match return content
if ((fperm.st_uid==i) && (fperm.st_mode & 0700 & permmask)) {
ap_rprintf(r, "Fichier propriétaire<br/>\r\n");
return (DECLINED);
}
// If file is group readable and primary group match return content
if ((fperm.st_gid==g) && (fperm.st_mode & 0070 & permmask)) {
ap_rprintf(r, "Fichier groupe<br/>\r\n");
return (DECLINED);
}
// now check supplemental groups
//ap_rprintf(r, "Fichier propriétaire %d %d %o %o<br/>\r\n", fperm.st_uid, i, fperm.st_mode, 0400);
gid_t grouplist[16];
int grouplistsize = 16;
int *groupreturn;
groupreturn = getgrouplist("jlcyr", g, grouplist, &grouplistsize);
if (groupreturn != -1) {
ap_rprintf(r, "OK liste des groupes (%d)<br/>\r\n", grouplistsize);
for (i=0; i<grouplistsize; i++) {
ap_rprintf(r, "group: %d\r\n", grouplist[i]);
// If file is group readable and match a supplemental group return content
if ((fperm.st_gid==grouplist[i]) && (fperm.st_mode & 0070 & permmask)) {
ap_rprintf(r, "Fichier groupe supplementaire<br/>\r\n");
return (DECLINED);
}
}
} else {
ap_rprintf(r, "Erreur<br/>\r\n");
return OK;
}
// else decline
ap_rprintf(r, "Aucuns droits de voir le fichier<br/>\r\n");
apr_table_setn(r->err_headers_out,
(PROXYREQ_PROXY == r->proxyreq) ? "Proxy-Authenticate"
: "WWW-Authenticate",
apr_pstrcat(r->pool, "Basic realm=\"", ap_auth_name(r),
"\"", NULL));
return HTTP_UNAUTHORIZED;
return OK;
}
////////////////////////////////////////////////////////////////
static void absec_register_hooks(apr_pool_t *p)
{
//ap_hook_handler(absec_handler, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_handler(absec_handler_last, NULL, NULL, APR_HOOK_LAST);
ap_hook_handler(absec_handler_first, NULL, NULL, APR_HOOK_FIRST);
}
////////////////////////////////////////////////////////////////
/* Dispatch list for API hooks */
module AP_MODULE_DECLARE_DATA absec_module = {
STANDARD20_MODULE_STUFF,
NULL, /* create per-dir config structures */
NULL, /* merge per-dir config structures */
NULL, /* create per-server config structures */
NULL, /* merge per-server config structures */
NULL, /* table of config file commands */
absec_register_hooks /* register hooks */
};