bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "apr_strings.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "apr_md5.h" /* for apr_password_validate */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "apr_lib.h" /* for apr_isspace */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "apr_base64.h" /* for apr_base64_decode et al */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#define APR_WANT_STRFUNC /* for strcasecmp */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "apr_want.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "ap_config.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "httpd.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "http_config.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "http_core.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "http_log.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "http_protocol.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "http_request.h"

70953fb44a7140fe206c3a5f011e24209c8c5c6abnicholes#include "ap_provider.h"

70953fb44a7140fe206c3a5f011e24209c8c5c6abnicholes#include "util_md5.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "mod_auth.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "mod_session.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#include "mod_request.h"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#define LOG_PREFIX "mod_auth_form: "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#define FORM_LOGIN_HANDLER "form-login-handler"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#define FORM_LOGOUT_HANDLER "form-logout-handler"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#define FORM_REDIRECT_HANDLER "form-redirect-handler"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes#define MOD_AUTH_FORM_HASH "site"

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic int (*ap_session_load_fn) (request_rec * r, session_rec ** z) = NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic void (*ap_session_get_fn) (request_rec * r, session_rec * z,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *key, const char **value) = NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic void (*ap_session_set_fn) (request_rec * r, session_rec * z,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *key, const char *value) = NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic int (*ap_parse_request_form_fn) (request_rec * r, ap_filter_t *f,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes apr_array_header_t ** ptr,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes apr_size_t num, apr_size_t size) = NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic void (*ap_request_insert_filter_fn) (request_rec * r) = NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic void (*ap_request_remove_filter_fn) (request_rec * r) = NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholestypedef struct {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes authn_provider_list *providers;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes char *dir;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int authoritative;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int authoritative_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *site;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int site_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *username;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int username_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *password;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int password_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes apr_size_t form_size;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int form_size_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int fakebasicauth;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int fakebasicauth_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *location;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int location_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *method;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int method_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *mimetype;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int mimetype_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *body;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int body_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int disable_no_store;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int disable_no_store_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *loginsuccess;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int loginsuccess_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *loginrequired;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int loginrequired_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *logout;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes int logout_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes} auth_form_config_rec;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic void *create_auth_form_dir_config(apr_pool_t * p, char *d)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = apr_pcalloc(p, sizeof(*conf));

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->dir = d;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /* Any failures are fatal. */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->authoritative = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /* form size defaults to 8k */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->form_size = HUGE_STRING_LEN;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /* default form field names */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->username = "httpd_username";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->password = "httpd_password";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->location = "httpd_location";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->method = "httpd_method";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->mimetype = "httpd_mimetype";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->body = "httpd_body";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return conf;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic void *merge_auth_form_dir_config(apr_pool_t * p, void *basev, void *addv)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *new = (auth_form_config_rec *) apr_pcalloc(p, sizeof(auth_form_config_rec));

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *add = (auth_form_config_rec *) addv;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *base = (auth_form_config_rec *) basev;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->providers = !add->providers ? base->providers : add->providers;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->authoritative = (add->authoritative_set == 0) ? base->authoritative : add->authoritative;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->authoritative_set = add->authoritative_set || base->authoritative_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->site = (add->site_set == 0) ? base->site : add->site;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->site_set = add->site_set || base->site_set;

0a39e7683f6611d66c55712f50bb240428d832a1bnicholes new->username = (add->username_set == 0) ? base->username : add->username;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->username_set = add->username_set || base->username_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->password = (add->password_set == 0) ? base->password : add->password;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->password_set = add->password_set || base->password_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->location = (add->location_set == 0) ? base->location : add->location;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->location_set = add->location_set || base->location_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->form_size = (add->form_size_set == 0) ? base->form_size : add->form_size;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->form_size_set = add->form_size_set || base->form_size_set;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->fakebasicauth = (add->fakebasicauth_set == 0) ? base->fakebasicauth : add->fakebasicauth;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->fakebasicauth_set = add->fakebasicauth_set || base->fakebasicauth_set;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->method = (add->method_set == 0) ? base->method : add->method;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->method_set = add->method_set || base->method_set;

036436f4f4cdcd76186c0058891216545967043bbnicholes new->mimetype = (add->mimetype_set == 0) ? base->mimetype : add->mimetype;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->mimetype_set = add->mimetype_set || base->mimetype_set;

41022996c916eb4ab2ec3204eb491b64779eb100bnicholes new->body = (add->body_set == 0) ? base->body : add->body;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->body_set = add->body_set || base->body_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->disable_no_store = (add->disable_no_store_set == 0) ? base->disable_no_store : add->disable_no_store;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->disable_no_store_set = add->disable_no_store_set || base->disable_no_store_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->loginsuccess = (add->loginsuccess_set == 0) ? base->loginsuccess : add->loginsuccess;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->loginsuccess_set = add->loginsuccess_set || base->loginsuccess_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->loginrequired = (add->loginrequired_set == 0) ? base->loginrequired : add->loginrequired;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->loginrequired_set = add->loginrequired_set || base->loginrequired_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->logout = (add->logout_set == 0) ? base->logout : add->logout;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes new->logout_set = add->logout_set || base->logout_set;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return new;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *add_authn_provider(cmd_parms * cmd, void *config,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *arg)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes authn_provider_list *newp;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes newp = apr_pcalloc(cmd->pool, sizeof(authn_provider_list));

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes newp->provider_name = apr_pstrdup(cmd->pool, arg);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /* lookup and cache the actual provider now */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes newp->provider = ap_lookup_provider(AUTHN_PROVIDER_GROUP,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes newp->provider_name,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AUTHN_PROVIDER_VERSION);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (newp->provider == NULL) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /*

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return apr_psprintf(cmd->pool,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "Unknown Authn provider: %s",

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes newp->provider_name);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!newp->provider->check_password) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /* if it doesn't provide the appropriate function, reject it */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return apr_psprintf(cmd->pool,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "The '%s' Authn provider doesn't support "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "Form Authentication", newp->provider_name);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!ap_session_load_fn || !ap_session_get_fn || !ap_session_set_fn) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes ap_session_load_fn = APR_RETRIEVE_OPTIONAL_FN(ap_session_load);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes ap_session_get_fn = APR_RETRIEVE_OPTIONAL_FN(ap_session_get);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes ap_session_set_fn = APR_RETRIEVE_OPTIONAL_FN(ap_session_set);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!ap_session_load_fn || !ap_session_get_fn || !ap_session_set_fn) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return "You must load mod_session to enable the mod_auth_form "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "functions";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!ap_parse_request_form_fn || !ap_request_insert_filter_fn || !ap_request_remove_filter_fn) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes ap_parse_request_form_fn = APR_RETRIEVE_OPTIONAL_FN(ap_parse_request_form);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes ap_request_insert_filter_fn = APR_RETRIEVE_OPTIONAL_FN(ap_request_insert_filter);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes ap_request_remove_filter_fn = APR_RETRIEVE_OPTIONAL_FN(ap_request_remove_filter);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!ap_parse_request_form_fn || !ap_request_insert_filter_fn || !ap_request_remove_filter_fn) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return "You must load mod_request to enable the mod_auth_form "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "functions";

56ab8639aed4d3b2f031d9c1160c5f40af01bdebjerenkrantz }

286fed73f9d1474652034465d4048247c6e7341fbnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes /* Add it to the list now. */

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!conf->providers) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->providers = newp;

56ab8639aed4d3b2f031d9c1160c5f40af01bdebjerenkrantz }

56ab8639aed4d3b2f031d9c1160c5f40af01bdebjerenkrantz else {

56ab8639aed4d3b2f031d9c1160c5f40af01bdebjerenkrantz authn_provider_list *last = conf->providers;

56ab8639aed4d3b2f031d9c1160c5f40af01bdebjerenkrantz

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes while (last->next) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes last = last->next;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

4f935de4900dc064a1e145be5e48f6af77ac24fcbnicholes last->next = newp;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *check_string(cmd_parms * cmd, const char *string)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (!string || !*string || ap_strchr_c(string, '=') || ap_strchr_c(string, '&')) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return apr_pstrcat(cmd->pool, cmd->directive->directive,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes " cannot be empty, or contain '=' or '&'.",

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes NULL);

440cda576ca9ff6476e4a04bdb253c5023da15eejerenkrantz }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_cookie_form_location(cmd_parms * cmd, void *config, const char *location)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

6f2fa094a76c27135a9825ca9492f9db0a1a3bc9bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->location = location;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->location_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return check_string(cmd, location);

3163ad7b2076b0f6961dc1a1ddaa06b240eecb7cjorton}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_cookie_form_username(cmd_parms * cmd, void *config, const char *username)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->username = username;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->username_set = 1;

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes return check_string(cmd, username);

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes}

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholesstatic const char *set_cookie_form_password(cmd_parms * cmd, void *config, const char *password)

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes{

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->password = password;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->password_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return check_string(cmd, password);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_cookie_form_method(cmd_parms * cmd, void *config, const char *method)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->method = method;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->method_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return check_string(cmd, method);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_cookie_form_mimetype(cmd_parms * cmd, void *config, const char *mimetype)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->mimetype = mimetype;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->mimetype_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return check_string(cmd, mimetype);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_cookie_form_body(cmd_parms * cmd, void *config, const char *body)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->body = body;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->body_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return check_string(cmd, body);

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_cookie_form_size(cmd_parms * cmd, void *config,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes const char *arg)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes apr_off_t size;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes if (APR_SUCCESS != apr_strtoff(&size, arg, NULL, 0)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes || size < 0 || size > APR_SIZE_MAX) {

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return "AuthCookieFormSize must be a size in bytes, or zero.";

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes }

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->form_size = (apr_size_t)size;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->form_size_set = 1;

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes

e76fdcdfb8994ad70776526f50fa013b3e9a6033bnicholes return NULL;

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes}

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholesstatic const char *set_login_required_location(cmd_parms * cmd, void *config, const char *loginrequired)

9558e9fdb620dd6f42ca93beac6c3ab734086706bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->loginrequired = loginrequired;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->loginrequired_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_login_success_location(cmd_parms * cmd, void *config, const char *loginsuccess)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->loginsuccess = loginsuccess;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->loginsuccess_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_logout_location(cmd_parms * cmd, void *config, const char *logout)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->logout = logout;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->logout_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return NULL;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_site_passphrase(cmd_parms * cmd, void *config, const char *site)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->site = site;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes conf->site_set = 1;

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes return NULL;

2e3a086879b1ac9681ea9ccf458096236f500dccbnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const char *set_authoritative(cmd_parms * cmd, void *config, int flag)

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes{

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

2e3a086879b1ac9681ea9ccf458096236f500dccbnicholes conf->authoritative = flag;

084aee5bd4093a1b5e9b51d1ccfafc3948fa4109bnicholes conf->authoritative_set = 1;

084aee5bd4093a1b5e9b51d1ccfafc3948fa4109bnicholes return NULL;

e76fdcdfb8994ad70776526f50fa013b3e9a6033bnicholes}

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes

e76fdcdfb8994ad70776526f50fa013b3e9a6033bnicholesstatic const char *set_fake_basic_auth(cmd_parms * cmd, void *config, int flag)

e76fdcdfb8994ad70776526f50fa013b3e9a6033bnicholes{

e76fdcdfb8994ad70776526f50fa013b3e9a6033bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes conf->fakebasicauth = flag;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes conf->fakebasicauth_set = 1;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes return NULL;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes}

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholesstatic const char *set_disable_no_store(cmd_parms * cmd, void *config, int flag)

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes{

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes auth_form_config_rec *conf = (auth_form_config_rec *) config;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes conf->disable_no_store = flag;

e76fdcdfb8994ad70776526f50fa013b3e9a6033bnicholes conf->disable_no_store_set = 1;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes return NULL;

509d30fddc88d129f9ba0f6000b802afa021fe52bnicholes}

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes

bb2b38cd44b032118359afbc743efbea12f48e61bnicholesstatic const command_rec auth_form_cmds[] =

2d25618c79d4f62bbd867a69b6d9c94a261be695bnicholes{

2e3a086879b1ac9681ea9ccf458096236f500dccbnicholes AP_INIT_ITERATE("AuthFormProvider", add_authn_provider, NULL, OR_AUTHCFG,

0f7cc4b1d3c42262bcdced99f682778963e83ea7bnicholes "specify the auth providers for a directory or location"),

5a1101aa8bb19d6bafb6c7808a56f49a95b0b769bnicholes AP_INIT_TAKE1("AuthFormUsername", set_cookie_form_username, NULL, OR_AUTHCFG,

5a1101aa8bb19d6bafb6c7808a56f49a95b0b769bnicholes "The field of the login form carrying the username"),

5a1101aa8bb19d6bafb6c7808a56f49a95b0b769bnicholes AP_INIT_TAKE1("AuthFormPassword", set_cookie_form_password, NULL, OR_AUTHCFG,

5a1101aa8bb19d6bafb6c7808a56f49a95b0b769bnicholes "The field of the login form carrying the password"),

5a1101aa8bb19d6bafb6c7808a56f49a95b0b769bnicholes AP_INIT_TAKE1("AuthFormLocation", set_cookie_form_location, NULL, OR_AUTHCFG,

0f7cc4b1d3c42262bcdced99f682778963e83ea7bnicholes "The field of the login form carrying the URL to redirect on "

233e163ab76ff3d9434939a65c6527f6e80be965bnicholes "successful login."),

0f7cc4b1d3c42262bcdced99f682778963e83ea7bnicholes AP_INIT_TAKE1("AuthFormMethod", set_cookie_form_method, NULL, OR_AUTHCFG,

0f7cc4b1d3c42262bcdced99f682778963e83ea7bnicholes "The field of the login form carrying the original request method."),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_TAKE1("AuthFormMimetype", set_cookie_form_mimetype, NULL, OR_AUTHCFG,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "The field of the login form carrying the original request mimetype."),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_TAKE1("AuthFormBody", set_cookie_form_body, NULL, OR_AUTHCFG,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "The field of the login form carrying the urlencoded original request "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "body."),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_TAKE1("AuthFormSize", set_cookie_form_size, NULL, ACCESS_CONF,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "Maximum size of body parsed by the form parser"),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_TAKE1("AuthFormLoginRequiredLocation", set_login_required_location,

a0209387ac93aa84037cf3a48096e75c6c8ce17ebnicholes NULL, OR_AUTHCFG,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "If set, redirect the browser to this URL rather than "

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes "return 401 Not Authorized."),

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes AP_INIT_TAKE1("AuthFormLoginSuccessLocation", set_login_success_location,

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes NULL, OR_AUTHCFG,

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes "If set, redirect the browser to this URL when a login "

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes "processed by the login handler is successful."),

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes AP_INIT_TAKE1("AuthFormLogoutLocation", set_logout_location,

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes NULL, OR_AUTHCFG,

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes "The URL of the logout successful page. An attempt to access an "

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes "URL handled by the handler " FORM_LOGOUT_HANDLER " will result "

273e1eccdc9e5b94f1e3e13e3ffca7360b6f461fbnicholes "in an redirect to this page after logout."),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_TAKE1("AuthFormSitePassphrase", set_site_passphrase,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes NULL, OR_AUTHCFG,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "If set, use this passphrase to determine whether the user should "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "be authenticated. Bypasses the user authentication check on "

8410c53aaf5e0372a19d5f4d2bc696b9c609ce3cbnicholes "every website hit, and is useful for high traffic sites."),

8410c53aaf5e0372a19d5f4d2bc696b9c609ce3cbnicholes AP_INIT_FLAG("AuthFormAuthoritative", set_authoritative,

8410c53aaf5e0372a19d5f4d2bc696b9c609ce3cbnicholes NULL, OR_AUTHCFG,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "Set to 'Off' to allow access control to be passed along to "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "lower modules if the UserID is not known to this module"),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_FLAG("AuthFormFakeBasicAuth", set_fake_basic_auth,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes NULL, OR_AUTHCFG,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "Set to 'On' to pass through authentication to the rest of the "

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes "server as a basic authentication header."),

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes AP_INIT_FLAG("AuthFormDisableNoStore", set_disable_no_store,

bb2b38cd44b032118359afbc743efbea12f48e61bnicholes NULL, OR_AUTHCFG,

"Set to 'on' to stop the sending of a Cache-Control no-store header with "

"the login screen. This allows the browser to cache the credentials, but "

"at the risk of it being possible for the login form to be resubmitted "

"and revealed to the backend server through XSS. Use at own risk."),

{NULL}

};

module AP_MODULE_DECLARE_DATA auth_form_module;

static void note_cookie_auth_failure(request_rec * r)

{

auth_form_config_rec *conf = ap_get_module_config(r->per_dir_config,

&auth_form_module);

if (conf->location && ap_strchr_c(conf->location, ':')) {

apr_table_setn(r->err_headers_out, "Location", conf->location);

}

}

static void set_notes_auth(request_rec * r,

const char *user, const char *pw,

const char *method, const char *mimetype)

{

apr_table_t *notes = NULL;

const char *authname;

/* find the main request */

while (r->main) {

r = r->main;

}

/* find the first redirect */

while (r->prev) {

r = r->prev;

}

notes = r->notes;

/* have we isolated the user and pw before? */

authname = ap_auth_name(r);

if (user) {

apr_table_setn(notes, apr_pstrcat(r->pool, authname, "-user", NULL), user);

}

if (pw) {

apr_table_setn(notes, apr_pstrcat(r->pool, authname, "-pw", NULL), pw);

}

if (method) {

apr_table_setn(notes, apr_pstrcat(r->pool, authname, "-method", NULL), method);

}

if (mimetype) {

apr_table_setn(notes, apr_pstrcat(r->pool, authname, "-mimetype", NULL), mimetype);

}

}

static void get_notes_auth(request_rec * r,

const char **user, const char **pw,

const char **method, const char **mimetype)

{

const char *authname;

/* find the main request */

while (r->main) {

r = r->main;

}

/* find the first redirect */

while (r->prev) {

r = r->prev;

}

/* have we isolated the user and pw before? */

authname = ap_auth_name(r);

if (user) {

*user = (char *) apr_table_get(r->notes, apr_pstrcat(r->pool, authname, "-user", NULL));

}

if (pw) {

*pw = (char *) apr_table_get(r->notes, apr_pstrcat(r->pool, authname, "-pw", NULL));

}

if (method) {

*method = (char *) apr_table_get(r->notes, apr_pstrcat(r->pool, authname, "-method", NULL));

}

if (mimetype) {

*mimetype = (char *) apr_table_get(r->notes, apr_pstrcat(r->pool, authname, "-mimetype", NULL));

}

}

static apr_status_t set_session_auth(request_rec * r,

const char *user, const char *pw, const char *site)

{

const char *hash = NULL;

const char *authname = ap_auth_name(r);

session_rec *z = NULL;

if (site) {

hash = ap_md5(r->pool,

(unsigned char *) apr_pstrcat(r->pool, user, ":", site, NULL));

}

ap_session_load_fn(r, &z);

ap_session_set_fn(r, z, apr_pstrcat(r->pool, authname, "-" MOD_SESSION_USER, NULL), user);

ap_session_set_fn(r, z, apr_pstrcat(r->pool, authname, "-" MOD_SESSION_PW, NULL), pw);

ap_session_set_fn(r, z, apr_pstrcat(r->pool, authname, "-" MOD_AUTH_FORM_HASH, NULL), hash);

return APR_SUCCESS;

}

static apr_status_t get_session_auth(request_rec * r,

const char **user, const char **pw, const char **hash)

{

const char *authname = ap_auth_name(r);

session_rec *z = NULL;

ap_session_load_fn(r, &z);

if (user) {

ap_session_get_fn(r, z, apr_pstrcat(r->pool, authname, "-" MOD_SESSION_USER, NULL), user);

}

if (pw) {

ap_session_get_fn(r, z, apr_pstrcat(r->pool, authname, "-" MOD_SESSION_PW, NULL), pw);

}

if (hash) {

ap_session_get_fn(r, z, apr_pstrcat(r->pool, authname, "-" MOD_AUTH_FORM_HASH, NULL), hash);

}

/* set the user, even though the user is unauthenticated at this point */

if (user && *user) {

r->user = (char *) *user;

}

return APR_SUCCESS;

}

static int get_form_auth(request_rec * r,

const char *username,

const char *password,

const char *location,

const char *method,

const char *mimetype,

const char *body,

const char **sent_user,

const char **sent_pw,

const char **sent_loc,

const char **sent_method,

const char **sent_mimetype,

apr_bucket_brigade **sent_body,

auth_form_config_rec * conf)

{

/* sanity check - are we a POST request? */

/* find the username and password in the form */

apr_array_header_t *pairs = NULL;

apr_off_t len;

apr_size_t size;

int res;

char *buffer;

/* have we isolated the user and pw before? */

get_notes_auth(r, sent_user, sent_pw, sent_method, sent_mimetype);

if (*sent_user && *sent_pw) {

return OK;

}

res = ap_parse_request_form_fn(r, NULL, &pairs, -1, conf->form_size);

if (res != OK) {

return res;

}

while (pairs && !apr_is_empty_array(pairs)) {

ap_form_pair_t *pair = (ap_form_pair_t *) apr_array_pop(pairs);

if (username && !strcmp(pair->name, username) && sent_user) {

apr_brigade_length(pair->value, 1, &len);

size = (apr_size_t) len;

buffer = apr_palloc(r->pool, size + 1);

apr_brigade_flatten(pair->value, buffer, &size);

buffer[len] = 0;

*sent_user = buffer;

}

else if (password && !strcmp(pair->name, password) && sent_pw) {

apr_brigade_length(pair->value, 1, &len);

size = (apr_size_t) len;

buffer = apr_palloc(r->pool, size + 1);

apr_brigade_flatten(pair->value, buffer, &size);

buffer[len] = 0;

*sent_pw = buffer;

}

else if (location && !strcmp(pair->name, location) && sent_loc) {

apr_brigade_length(pair->value, 1, &len);

size = (apr_size_t) len;

buffer = apr_palloc(r->pool, size + 1);

apr_brigade_flatten(pair->value, buffer, &size);

buffer[len] = 0;

*sent_loc = buffer;

}

else if (method && !strcmp(pair->name, method) && sent_method) {

apr_brigade_length(pair->value, 1, &len);

size = (apr_size_t) len;

buffer = apr_palloc(r->pool, size + 1);

apr_brigade_flatten(pair->value, buffer, &size);

buffer[len] = 0;

*sent_method = buffer;

}

else if (mimetype && !strcmp(pair->name, mimetype) && sent_mimetype) {

apr_brigade_length(pair->value, 1, &len);

size = (apr_size_t) len;

buffer = apr_palloc(r->pool, size + 1);

apr_brigade_flatten(pair->value, buffer, &size);

buffer[len] = 0;

*sent_mimetype = buffer;

}

else if (body && !strcmp(pair->name, body) && sent_body) {

*sent_body = pair->value;

}

}

/* set the user, even though the user is unauthenticated at this point */

if (*sent_user) {

r->user = (char *) *sent_user;

}

/* a missing username or missing password means auth denied */

if (!sent_user || !*sent_user || !sent_pw || !*sent_pw) {

return HTTP_UNAUTHORIZED;

}

/*

set_notes_auth(r, *sent_user, *sent_pw, *sent_method, *sent_mimetype);

return OK;

}

static int check_site(request_rec * r, const char *site, const char *sent_user, const char *sent_hash)

{

if (site && sent_user && sent_hash) {

const char *hash = ap_md5(r->pool,

(unsigned char *) apr_pstrcat(r->pool, sent_user, ":", site, NULL));

if (!strcmp(sent_hash, hash)) {

return OK;

}

else {

return AUTH_USER_NOT_FOUND;

}

}

return DECLINED;

}

static int check_authn(request_rec * r, const char *sent_user, const char *sent_pw)

{

authn_status auth_result;

authn_provider_list *current_provider;

auth_form_config_rec *conf = ap_get_module_config(r->per_dir_config,

&auth_form_module);

current_provider = conf->providers;

do {

const authn_provider *provider;

/*

if (!current_provider) {

provider = ap_lookup_provider(AUTHN_PROVIDER_GROUP,

AUTHN_DEFAULT_PROVIDER,

AUTHN_PROVIDER_VERSION);

if (!provider || !provider->check_password) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, LOG_PREFIX

"no authn provider configured");

auth_result = AUTH_GENERAL_ERROR;

break;

}

apr_table_setn(r->notes, AUTHN_PROVIDER_NAME_NOTE, AUTHN_DEFAULT_PROVIDER);

}

else {

provider = current_provider->provider;

apr_table_setn(r->notes, AUTHN_PROVIDER_NAME_NOTE, current_provider->provider_name);

}

if (!sent_user || !sent_pw) {

auth_result = AUTH_USER_NOT_FOUND;

break;

}

auth_result = provider->check_password(r, sent_user, sent_pw);

apr_table_unset(r->notes, AUTHN_PROVIDER_NAME_NOTE);

/* Something occured. Stop checking. */

if (auth_result != AUTH_USER_NOT_FOUND) {

break;

}

/* If we're not really configured for providers, stop now. */

if (!conf->providers) {

break;

}

current_provider = current_provider->next;

} while (current_provider);

if (auth_result != AUTH_GRANTED) {

int return_code;

/* If we're not authoritative, then any error is ignored. */

if (!(conf->authoritative) && auth_result != AUTH_DENIED) {

return DECLINED;

}

switch (auth_result) {

case AUTH_DENIED:

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, LOG_PREFIX

"user '%s': authentication failure for \"%s\": "

"password Mismatch",

sent_user, r->uri);

return_code = HTTP_UNAUTHORIZED;

break;

case AUTH_USER_NOT_FOUND:

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, LOG_PREFIX

"user '%s' not found: %s", sent_user, r->uri);

return_code = HTTP_UNAUTHORIZED;

break;

case AUTH_GENERAL_ERROR:

default:

/*

return_code = HTTP_INTERNAL_SERVER_ERROR;

break;

}

/* If we're returning 403, tell them to try again. */

if (return_code == HTTP_UNAUTHORIZED) {

note_cookie_auth_failure(r);

}

return return_code;

}

return OK;

}

static void fake_basic_authentication(request_rec *r, auth_form_config_rec *conf,

const char *user, const char *pw)

{

if (conf->fakebasicauth) {

char *basic = apr_pstrcat(r->pool, user, ":", pw, NULL);

apr_size_t size = (apr_size_t) strlen(basic);

char *base64 = apr_palloc(r->pool,

apr_base64_encode_len(size + 1) * sizeof(char));

apr_base64_encode(base64, basic, size);

apr_table_set(r->headers_in, "Authorization",

apr_pstrcat(r->pool, "Basic ", base64, NULL));

}

}

static int authenticate_form_authn(request_rec * r)

{

auth_form_config_rec *conf = ap_get_module_config(r->per_dir_config,

&auth_form_module);

const char *sent_user = NULL, *sent_pw = NULL, *sent_hash = NULL;

const char *sent_loc = NULL, *sent_method = "GET", *sent_mimetype = NULL;

const char *current_auth = NULL;

apr_status_t res;

int rv = HTTP_UNAUTHORIZED;

/* Are we configured to be Form auth? */

current_auth = ap_auth_type(r);

if (!current_auth || strcasecmp(current_auth, "form")) {

return DECLINED;

}

/*

if (PROXYREQ_PROXY == r->proxyreq) {

ap_log_rerror(APLOG_MARK, APLOG_ERR,

0, r, LOG_PREFIX "form auth cannot be used for proxy "

"requests due to XSS risk, access denied: %s", r->uri);

return HTTP_INTERNAL_SERVER_ERROR;

}

/* We need an authentication realm. */

if (!ap_auth_name(r)) {

ap_log_rerror(APLOG_MARK, APLOG_ERR,

0, r, LOG_PREFIX "need AuthName: %s", r->uri);

return HTTP_INTERNAL_SERVER_ERROR;

}

r->ap_auth_type = (char *) current_auth;

/* try get the username and password from the notes, if present */

get_notes_auth(r, &sent_user, &sent_pw, &sent_method, &sent_mimetype);

if (!sent_user || !sent_pw || !*sent_user || !*sent_pw) {

/* otherwise try get the username and password from a session, if present */

res = get_session_auth(r, &sent_user, &sent_pw, &sent_hash);

}

else {

res = APR_SUCCESS;

}

/* first test whether the site passphrase matches */

if (APR_SUCCESS == res && sent_user && sent_hash && sent_pw) {

rv = check_site(r, conf->site, sent_user, sent_hash);

if (OK == rv) {

fake_basic_authentication(r, conf, sent_user, sent_pw);

return OK;

}

}

/* otherwise test for a normal password match */

if (APR_SUCCESS == res && sent_user && sent_pw) {

rv = check_authn(r, sent_user, sent_pw);

if (OK == rv) {

fake_basic_authentication(r, conf, sent_user, sent_pw);

return OK;

}

}

/*

if (HTTP_UNAUTHORIZED == rv && r->method_number == M_POST && ap_is_initial_req(r)) {

request_rec *rr;

apr_bucket_brigade *sent_body = NULL;

/* create a subrequest of our current uri */

rr = ap_sub_req_lookup_uri(r->uri, r, r->input_filters);

rr->headers_in = r->headers_in;

/* run the insert_filters hook on the subrequest to ensure a body read can

ap_run_insert_filter(rr);

/* parse the form by reading the subrequest */

rv = get_form_auth(rr, conf->username, conf->password, conf->location,

conf->method, conf->mimetype, conf->body,

&sent_user, &sent_pw, &sent_loc, &sent_method,

&sent_mimetype, &sent_body, conf);

/* make sure any user detected within the subrequest is saved back to

r->user = apr_pstrdup(r->pool, rr->user);

/* we cannot clean up rr at this point, as memory allocated to rr is

/* insert the kept_body filter on the main request to guarantee the

if (sent_body && sent_mimetype) {

apr_table_set(r->headers_in, "Content-Type", sent_mimetype);

r->kept_body = sent_body;

}

else {

r->kept_body = apr_brigade_create(r->pool, r->connection->bucket_alloc);

}

ap_request_insert_filter_fn(r);

/* did the form ask to change the method? if so, switch in the redirect handler

if (sent_method && strcmp(r->method, sent_method)) {

r->handler = FORM_REDIRECT_HANDLER;

}

/* check the authn in the main request, based on the username found */

if (OK == rv) {

rv = check_authn(r, sent_user, sent_pw);

if (OK == rv) {

fake_basic_authentication(r, conf, sent_user, sent_pw);

set_session_auth(r, sent_user, sent_pw, conf->site);

if (sent_loc) {

apr_table_set(r->headers_out, "Location", sent_loc);

return HTTP_MOVED_PERMANENTLY;

}

if (conf->loginsuccess) {

apr_table_set(r->headers_out, "Location", conf->loginsuccess);

return HTTP_MOVED_PERMANENTLY;

}

}

}

}

/*

if (HTTP_UNAUTHORIZED == rv && conf->loginrequired) {

apr_table_set(r->headers_out, "Location", conf->loginrequired);

return HTTP_MOVED_PERMANENTLY;

}

/* did the user ask to be redirected on login success? */

if (sent_loc) {

apr_table_set(r->headers_out, "Location", sent_loc);

rv = HTTP_MOVED_PERMANENTLY;

}

/*

if (HTTP_UNAUTHORIZED == rv && !conf->disable_no_store) {

apr_table_addn(r->headers_out, "Cache-Control", "no-store");

apr_table_addn(r->err_headers_out, "Cache-Control", "no-store");

}

return rv;

}

static int authenticate_form_login_handler(request_rec * r)

{

auth_form_config_rec *conf = ap_get_module_config(r->per_dir_config,

&auth_form_module);

const char *sent_user = NULL, *sent_pw = NULL, *sent_loc = NULL;

int rv;

if (strcmp(r->handler, FORM_LOGIN_HANDLER)) {

return DECLINED;

}

if (r->method_number != M_POST) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, LOG_PREFIX

"the " FORM_LOGIN_HANDLER " only supports the POST method for %s",

r->uri);

return HTTP_METHOD_NOT_ALLOWED;

}

rv = get_form_auth(r, conf->username, conf->password, conf->location,

NULL, NULL, NULL,

&sent_user, &sent_pw, &sent_loc,

NULL, NULL, NULL, conf);

if (OK == rv) {

rv = check_authn(r, sent_user, sent_pw);

if (OK == rv) {

set_session_auth(r, sent_user, sent_pw, conf->site);

if (sent_loc) {

apr_table_set(r->headers_out, "Location", sent_loc);

return HTTP_MOVED_PERMANENTLY;

}

if (conf->loginsuccess) {

apr_table_set(r->headers_out, "Location", conf->loginsuccess);

return HTTP_MOVED_PERMANENTLY;

}

return HTTP_OK;

}

}

/* did we prefer to be redirected to the login page on failure instead? */

if (HTTP_UNAUTHORIZED == rv && conf->loginrequired) {

apr_table_set(r->headers_out, "Location", conf->loginrequired);

return HTTP_MOVED_PERMANENTLY;

}

return rv;

}

static int authenticate_form_logout_handler(request_rec * r)

{

auth_form_config_rec *conf = ap_get_module_config(r->per_dir_config,

&auth_form_module);

if (strcmp(r->handler, FORM_LOGOUT_HANDLER)) {

return DECLINED;

}

/* remove the username and password, effectively logging the user out */

set_session_auth(r, NULL, NULL, NULL);

/*

apr_table_addn(r->headers_out, "Cache-Control", "no-store");

apr_table_addn(r->err_headers_out, "Cache-Control", "no-store");

/* if set, internal redirect to the logout page */

if (conf->logout) {

apr_table_addn(r->headers_out, "Location", conf->logout);

return HTTP_TEMPORARY_REDIRECT;

}

return HTTP_OK;

}

static int authenticate_form_redirect_handler(request_rec * r)

{

request_rec *rr = NULL;

const char *sent_method = NULL, *sent_mimetype = NULL;

if (strcmp(r->handler, FORM_REDIRECT_HANDLER)) {

return DECLINED;

}

/* get the method and mimetype from the notes */

get_notes_auth(r, NULL, NULL, &sent_method, &sent_mimetype);

if (r->kept_body && sent_method && sent_mimetype) {

ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, LOG_PREFIX

"internal redirect to method '%s' and body mimetype '%s' for the "

"uri: %s", sent_method, sent_mimetype, r->uri);

rr = ap_sub_req_method_uri(sent_method, r->uri, r, r->output_filters);

r->status = ap_run_sub_req(rr);

}

else {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, LOG_PREFIX

"internal redirect requested but one or all of method, mimetype or "

"body are NULL: %s", r->uri);

return HTTP_INTERNAL_SERVER_ERROR;

}

/* return the underlying error, or OK on success */

return r->status == HTTP_OK || r->status == OK ? OK : r->status;

}

static void register_hooks(apr_pool_t * p)

{

#if AP_MODULE_MAGIC_AT_LEAST(20080403,1)

ap_hook_check_authn(authenticate_form_authn, NULL, NULL, APR_HOOK_MIDDLE,

AP_AUTH_INTERNAL_PER_CONF);

#else

ap_hook_check_user_id(authenticate_form_authn, NULL, NULL, APR_HOOK_MIDDLE);

#endif

ap_hook_handler(authenticate_form_login_handler, NULL, NULL, APR_HOOK_MIDDLE);

ap_hook_handler(authenticate_form_logout_handler, NULL, NULL, APR_HOOK_MIDDLE);

ap_hook_handler(authenticate_form_redirect_handler, NULL, NULL, APR_HOOK_MIDDLE);

}

module AP_MODULE_DECLARE_DATA auth_form_module =

{

STANDARD20_MODULE_STUFF,

create_auth_form_dir_config, /* dir config creater */

merge_auth_form_dir_config, /* dir merger --- default is to override */

NULL, /* server config */

NULL, /* merge server config */

auth_form_cmds, /* command apr_table_t */

register_hooks /* register hooks */

};