mod_authn_dbm.c revision bd4652a29e911de608063bf3ab4a2dfb9deee331
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding/* ====================================================================
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * The Apache Software License, Version 1.1
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding *
b99dbaab171d91e1b664397cc40e039d0c087c65fielding * Copyright (c) 2000-2002 The Apache Software Foundation. All rights
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * reserved.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * Redistribution and use in source and binary forms, with or without
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * modification, are permitted provided that the following conditions
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * are met:
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * 1. Redistributions of source code must retain the above copyright
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * notice, this list of conditions and the following disclaimer.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * 2. Redistributions in binary form must reproduce the above copyright
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * notice, this list of conditions and the following disclaimer in
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * the documentation and/or other materials provided with the
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * distribution.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * 3. The end-user documentation included with the redistribution,
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * if any, must include the following acknowledgment:
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * "This product includes software developed by the
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * Apache Software Foundation (http://www.apache.org/)."
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * Alternately, this acknowledgment may appear in the software itself,
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * if and wherever such third-party acknowledgments normally appear.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * 4. The names "Apache" and "Apache Software Foundation" must
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * not be used to endorse or promote products derived from this
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * software without prior written permission. For written
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * permission, please contact apache@apache.org.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * 5. Products derived from this software may not be called "Apache",
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * nor may "Apache" appear in their name, without prior written
64185f9824e42f21ca7b9ae6c004484215c031a7rbb * permission of the Apache Software Foundation.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * SUCH DAMAGE.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * ====================================================================
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * This software consists of voluntary contributions made by many
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * individuals on behalf of the Apache Software Foundation. For more
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * information on the Apache Software Foundation, please see
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * <http://www.apache.org/>.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * Portions of this software are based upon public domain software
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * originally written at the National Center for Supercomputing Applications,
ab2c1c1c83ec91415565da5a71fbc15d9685caa6fielding * University of Illinois, Urbana-Champaign.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding/*
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * http_auth: authentication
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * Rob McCool & Brian Behlendorf.
b6055b7832a0e4d0818416252fff5925aaebae4brbb *
2d71630471d1c23f0137309e3c3957c633ecbfd6rbb * Adapted to Apache by rst.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding *
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * dirkx - Added Authoritative control to allow passing on to lower
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * modules if and only if the userid is not known to this
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * module. A known user with a faulty or absent password still
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * causes an AuthRequired. The default is 'Authoritative', i.e.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding * no control is passed along.
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#define APR_WANT_STRFUNC
3d96ee83babeec32482c9082c9426340cee8c44dwrowe#include "apr_want.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "apr_strings.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "apr_dbm.h"
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm#include "apr_md5.h" /* for apr_password_validate */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "httpd.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "http_config.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "http_core.h"
4f9a74ad7e44b0464f7cf56525a205d788becacbtrawick#include "http_log.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "http_protocol.h"
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "http_request.h" /* for ap_hook_(check_user_id | auth_checker)*/
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding#include "mod_auth.h"
066877f1a045103acfdd376d48cdd473c33f409bdougm
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingtypedef struct {
066877f1a045103acfdd376d48cdd473c33f409bdougm char *pwfile;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding char *dbmtype;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding int authoritative;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding} authn_dbm_config_rec;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic void *create_authn_dbm_dir_config(apr_pool_t *p, char *d)
4f9a74ad7e44b0464f7cf56525a205d788becacbtrawick{
4f9a74ad7e44b0464f7cf56525a205d788becacbtrawick authn_dbm_config_rec *conf = apr_palloc(p, sizeof(*conf));
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding conf->pwfile = NULL;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding conf->dbmtype = "default";
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm conf->authoritative = 1; /* fortress is secure by default */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return conf;
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic const char *set_dbm_type(cmd_parms *cmd,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding void *dir_config,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding const char *arg)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm authn_dbm_config_rec *conf = dir_config;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm conf->dbmtype = apr_pstrdup(cmd->pool, arg);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return NULL;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic const command_rec authn_dbm_cmds[] =
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding AP_INIT_TAKE1("AuthDBMUserFile", ap_set_file_slot,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding (void *)APR_OFFSETOF(authn_dbm_config_rec, pwfile),
0958c822c32923b9848a73b2f4c94eab07fb416drbb OR_AUTHCFG, "dbm database file containing user IDs and passwords"),
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding AP_INIT_TAKE1("AuthDBMType", set_dbm_type,
c0905aec36b287200b8a255b33fba6c975752bdfgstein NULL,
c0905aec36b287200b8a255b33fba6c975752bdfgstein OR_AUTHCFG, "what type of DBM file the user file is"),
e95f5a6ebefb83d0e8a82cbc4db7d354957a817dben AP_INIT_FLAG("AuthDBMAuthoritative", ap_set_flag_slot,
957b9b3f5e47c6cc7c2d8d9e2224c7364e966c70rbb (void *)APR_OFFSETOF(authn_dbm_config_rec, authoritative),
e95f5a6ebefb83d0e8a82cbc4db7d354957a817dben OR_AUTHCFG, "Set to 'no' to allow access control to be passed along to lower modules, if the UserID is not known in this module"),
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding {NULL}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding};
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
1ccd992d37d62c8cb2056126f2234f64ec189bfddougmmodule AP_MODULE_DECLARE_DATA authn_dbm_module;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic apr_status_t fetch_dbm(const char *dbmtype, const char *dbmfile,
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm const char *user, apr_datum_t *val,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_pool_t *pool)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm apr_dbm_t *f;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_datum_t key;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_status_t rv;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
c0905aec36b287200b8a255b33fba6c975752bdfgstein rv = apr_dbm_open_ex(&f, dbmtype, dbmfile, APR_DBM_READONLY,
0958c822c32923b9848a73b2f4c94eab07fb416drbb APR_OS_DEFAULT, pool);
0958c822c32923b9848a73b2f4c94eab07fb416drbb
0958c822c32923b9848a73b2f4c94eab07fb416drbb if (rv != APR_SUCCESS) {
0958c822c32923b9848a73b2f4c94eab07fb416drbb return rv;
0958c822c32923b9848a73b2f4c94eab07fb416drbb }
0958c822c32923b9848a73b2f4c94eab07fb416drbb
0958c822c32923b9848a73b2f4c94eab07fb416drbb key.dptr = (char*)user;
0958c822c32923b9848a73b2f4c94eab07fb416drbb#ifndef NETSCAPE_DBM_COMPAT
0958c822c32923b9848a73b2f4c94eab07fb416drbb key.dsize = strlen(key.dptr);
0958c822c32923b9848a73b2f4c94eab07fb416drbb#else
0958c822c32923b9848a73b2f4c94eab07fb416drbb key.dsize = strlen(key.dptr) + 1;
0958c822c32923b9848a73b2f4c94eab07fb416drbb#endif
0958c822c32923b9848a73b2f4c94eab07fb416drbb
0958c822c32923b9848a73b2f4c94eab07fb416drbb rv = apr_dbm_fetch(f, key, val);
0958c822c32923b9848a73b2f4c94eab07fb416drbb
0958c822c32923b9848a73b2f4c94eab07fb416drbb apr_dbm_close(f);
0958c822c32923b9848a73b2f4c94eab07fb416drbb
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return rv;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic authn_status check_dbm_pw(request_rec *r, const char *user,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding const char *password)
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding authn_dbm_config_rec *conf = ap_get_module_config(r->per_dir_config,
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm &authn_dbm_module);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_datum_t dbm_pw;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding apr_status_t rv;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding char *dbm_password;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding rv = fetch_dbm(conf->dbmtype, conf->pwfile, user, &dbm_pw, r->pool);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (rv != APR_SUCCESS) {
8f3ec4772d2aeb347cf40e87c77627bb784dd018rbb ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding "could not open dbm (type %s) auth file: %s",
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding conf->dbmtype, conf->pwfile);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return AUTH_GENERAL_ERROR;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (dbm_pw.dptr) {
85bea52867bd1a8c81080ba415b5cd5b771ce5f7gstein dbm_password = apr_pstrmemdup(r->pool, dbm_pw.dptr, dbm_pw.dsize);
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
d9f2c22804bcbc9ad07d4ec18fbb8aa7c042dcd0bjh
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (!dbm_password) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return AUTH_USER_NOT_FOUND;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding rv = apr_password_validate(password, dbm_password);
1ccd992d37d62c8cb2056126f2234f64ec189bfddougm
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding if (rv != APR_SUCCESS) {
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return AUTH_DENIED;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding }
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding return AUTH_GRANTED;
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingstatic const authn_provider authn_dbm_provider =
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding &check_dbm_pw,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding NULL, /* No realm support yet. */
10a4cdd68ef1ca0e54af296fe1d08ac00150c90bwrowe};
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
066877f1a045103acfdd376d48cdd473c33f409bdougmstatic void register_hooks(apr_pool_t *p)
066877f1a045103acfdd376d48cdd473c33f409bdougm{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding authn_register_provider(p, "dbm", &authn_dbm_provider);
066877f1a045103acfdd376d48cdd473c33f409bdougm}
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding
0f081398cf0eef8cc7c66a535d450110a92dc8aefieldingmodule AP_MODULE_DECLARE_DATA authn_dbm_module =
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding{
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding STANDARD20_MODULE_STUFF,
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding create_authn_dbm_dir_config, /* dir config creater */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding NULL, /* dir merger --- default is to override */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding NULL, /* server config */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding NULL, /* merge server config */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding authn_dbm_cmds, /* command apr_table_t */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding register_hooks /* register hooks */
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding};
0f081398cf0eef8cc7c66a535d450110a92dc8aefielding