From dbbf162dc9be0aef47f2d1f1fcddb7ae4e074d47 Mon Sep 17 00:00:00 2001 From: Stef Walter Date: Wed, 28 Apr 2004 20:59:48 +0000 Subject: Tons of fixes, debugging, changes, added apache module --- daemon/simple.c | 143 ++++++++++++++++++++++++++++++-------------------------- 1 file changed, 76 insertions(+), 67 deletions(-) (limited to 'daemon/simple.c') diff --git a/daemon/simple.c b/daemon/simple.c index 4c7fb28..5b4eb60 100644 --- a/daemon/simple.c +++ b/daemon/simple.c @@ -25,18 +25,12 @@ unsigned char g_simple_secret[DIGEST_SECRET_LEN]; typedef struct simple_context { + /* Settings ----------------------------------------------------------- */ const char* filename; /* The file name with the user names */ - const char* realm; /* The realm for basic authentication */ - const char* domains; /* Domains for which digest auth is valid */ - int cache_max; /* Maximum number of connections at once */ - int cache_timeout; + ha_options_t* opts; /* Options from httpauthd.c */ /* Context ----------------------------------------------------------- */ hash_t* cache; /* Some cached records or basic */ - -#ifdef _DEBUG - const char* debug_nonce; -#endif } simple_context_t; @@ -57,7 +51,7 @@ static digest_record_t* get_cached_digest(simple_context_t* ctx, unsigned char* ASSERT(ctx && nonce); - if(ctx->cache_max == 0) + if(ctx->opts->cache_max == 0) return NULL; ha_lock(NULL); @@ -95,7 +89,7 @@ static int save_cached_digest(simple_context_t* ctx, digest_record_t* rec) ASSERT(ctx && rec); - if(ctx->cache_max == 0) + if(ctx->opts->cache_max == 0) { free_hash_object(NULL, rec); return HA_FALSE; @@ -103,7 +97,7 @@ static int save_cached_digest(simple_context_t* ctx, digest_record_t* rec) ha_lock(NULL); - while(hash_count(ctx->cache) >= ctx->cache_max) + while(hash_count(ctx->cache) >= ctx->opts->cache_max) hash_bump(ctx->cache); r = hash_set(ctx->cache, rec->nonce, rec); @@ -126,12 +120,12 @@ static int add_cached_basic(simple_context_t* ctx, unsigned char* key) ASSERT(ctx && key); - if(ctx->cache_max == 0) + if(ctx->opts->cache_max == 0) return HA_FALSE; ha_lock(NULL); - while(hash_count(ctx->cache) >= ctx->cache_max) + while(hash_count(ctx->cache) >= ctx->opts->cache_max) hash_bump(ctx->cache); r = hash_set(ctx->cache, key, BASIC_ESTABLISHED); @@ -158,11 +152,12 @@ static int complete_digest_ha1(simple_context_t* ctx, digest_record_t* rec, int ret = HA_FALSE; ASSERT(ctx && rec && buf && user && user[0]); + ha_messagex(LOG_DEBUG, "searching password file for user's ha1: %s", user); f = fopen(ctx->filename, "r"); if(!f) { - ha_message(LOG_ERR, "can't open file for basic auth: %s", ctx->filename); + ha_message(LOG_ERR, "simple: can't open file for basic auth: %s", ctx->filename); return HA_FAILED; } @@ -178,7 +173,7 @@ static int complete_digest_ha1(simple_context_t* ctx, digest_record_t* rec, if(ferror(f)) { - ha_message(LOG_ERR, "error reading basic password file"); + ha_message(LOG_ERR, "simple: error reading basic password file"); ret = HA_FAILED; break; } @@ -201,7 +196,7 @@ static int complete_digest_ha1(simple_context_t* ctx, digest_record_t* rec, t2++; /* Check the realm */ - if(strcmp(t, ctx->realm) == 0) + if(strcmp(t, ctx->opts->realm) == 0) { len = MD5_LEN; @@ -209,6 +204,7 @@ static int complete_digest_ha1(simple_context_t* ctx, digest_record_t* rec, t = ha_bufdechex(buf, t2, &len); if(t && len == MD5_LEN) { + ha_messagex(LOG_DEBUG, "simple: found ha1 for user: %s", user); memcpy(rec->ha1, t, MD5_LEN); ret = HA_OK; break; @@ -217,7 +213,7 @@ static int complete_digest_ha1(simple_context_t* ctx, digest_record_t* rec, } if(!t2 || ret != HA_OK) - ha_messagex(LOG_WARNING, "user '%s' found in file, but password not in digest format", user); + ha_messagex(LOG_WARNING, "simple: user '%s' found in file, but password not in digest format", user); } } } @@ -243,15 +239,16 @@ static int validate_user_password(simple_context_t* ctx, ha_buffer_t* buf, ASSERT(ctx && buf); ASSERT(user && user[0] && clearpw); + ha_messagex(LOG_DEBUG, "simple: validating user against password file: %s", user); f = fopen(ctx->filename, "r"); if(!f) { - ha_message(LOG_ERR, "can't open file for basic auth: %s", ctx->filename); + ha_message(LOG_ERR, "simple: can't open file for basic auth: %s", ctx->filename); return HA_FAILED; } - digest_makeha1(ha1, user, ctx->realm, clearpw); + digest_makeha1(ha1, user, ctx->opts->realm, clearpw); /* * Note: There should be no returns or jumps between @@ -265,7 +262,7 @@ static int validate_user_password(simple_context_t* ctx, ha_buffer_t* buf, if(ferror(f)) { - ha_message(LOG_ERR, "error reading basic password file"); + ha_message(LOG_ERR, "simple: error reading basic password file"); ret = HA_FAILED; break; } @@ -298,6 +295,7 @@ static int validate_user_password(simple_context_t* ctx, ha_buffer_t* buf, if(strcmp(crypt(clearpw, t), t) == 0) { + ha_messagex(LOG_DEBUG, "simple: found valid crypt password for user: %s", user); ret = HA_OK; break; } @@ -310,7 +308,7 @@ static int validate_user_password(simple_context_t* ctx, ha_buffer_t* buf, t2++; /* Check the realm */ - if(strcmp(t, ctx->realm) == 0) + if(strcmp(t, ctx->opts->realm) == 0) { len = MD5_LEN; @@ -318,6 +316,7 @@ static int validate_user_password(simple_context_t* ctx, ha_buffer_t* buf, t = ha_bufdechex(buf, t2, &len); if(t && len == MD5_LEN && memcmp(ha1, t, MD5_LEN) == 0) { + ha_messagex(LOG_DEBUG, "simple: found valid ha1 for user: %s", user); ret = HA_OK; break; } @@ -356,6 +355,7 @@ static int simple_basic_response(simple_context_t* ctx, const char* header, /* Check and see if this connection is in the cache */ if(have_cached_basic(ctx, basic.key)) { + ha_messagex(LOG_NOTICE, "simple: validated basic user against cache: %s", basic.user); found = 1; ret = HA_OK; goto finally; @@ -369,9 +369,15 @@ static int simple_basic_response(simple_context_t* ctx, const char* header, ret = validate_user_password(ctx, buf, basic.user, basic.password); + if(ret == HA_OK) + ha_messagex(LOG_NOTICE, "simple: validated basic user against file: %s", basic.user); + + else + ha_messagex(LOG_WARNING, "simple: basic authentication failed for user: %s", basic.user); + finally: - if(ret = HA_OK) + if(ret == HA_OK) { resp->code = HA_SERVER_ACCEPT; resp->detail = basic.user; @@ -384,7 +390,7 @@ finally: } static int simple_digest_challenge(simple_context_t* ctx, ha_response_t* resp, - ha_buffer_t* buf, int stale) + ha_buffer_t* buf, int stale) { const char* nonce_str; const char* header; @@ -394,10 +400,10 @@ static int simple_digest_challenge(simple_context_t* ctx, ha_response_t* resp, /* Generate an nonce */ #ifdef _DEBUG - if(ctx->debug_nonce) + if(ctx->opts->digest_debugnonce) { - nonce_str = ctx->debug_nonce; - ha_messagex(LOG_WARNING, "using debug nonce. security non-existant."); + nonce_str = ctx->opts->digest_debugnonce; + ha_messagex(LOG_WARNING, "simple: using debug nonce. security non-existant."); } else #endif @@ -412,7 +418,8 @@ static int simple_digest_challenge(simple_context_t* ctx, ha_response_t* resp, /* Now generate a message to send */ - header = digest_challenge(buf, nonce_str, ctx->realm, ctx->domains, stale); + header = digest_challenge(buf, nonce_str, ctx->opts->realm, + ctx->opts->digest_domains, stale); if(!header) return HA_CRITERROR; @@ -421,6 +428,7 @@ static int simple_digest_challenge(simple_context_t* ctx, ha_response_t* resp, resp->code = HA_SERVER_DECLINE; ha_addheader(resp, "WWW-Authenticate", header); + ha_messagex(LOG_DEBUG, "simple: created digest challenge with nonce: %s", nonce_str); return HA_OK; } @@ -446,18 +454,18 @@ static int simple_digest_response(simple_context_t* ctx, const char* header, return r; #ifdef _DEBUG - if(ctx->debug_nonce) + if(ctx->opts->digest_debugnonce) { - if(dg.nonce && strcmp(dg.nonce, ctx->debug_nonce) != 0) + if(dg.nonce && strcmp(dg.nonce, ctx->opts->digest_debugnonce) != 0) { resp->code = HA_SERVER_BADREQ; ret = HA_FALSE; - ha_messagex(LOG_WARNING, "digest response contains invalid nonce"); + ha_messagex(LOG_WARNING, "simple: digest response contains invalid nonce"); goto finally; } /* Do a rough hash into the real nonce, for use as a key */ - md5_string(nonce, ctx->debug_nonce); + md5_string(nonce, ctx->opts->digest_debugnonce); /* Debug nonce's never expire */ expiry = time(NULL); @@ -471,7 +479,7 @@ static int simple_digest_response(simple_context_t* ctx, const char* header, if(r == HA_FALSE) { resp->code = HA_SERVER_BADREQ; - ha_messagex(LOG_WARNING, "digest response contains invalid nonce"); + ha_messagex(LOG_WARNING, "simple: digest response contains invalid nonce"); } ret = r; @@ -482,14 +490,19 @@ static int simple_digest_response(simple_context_t* ctx, const char* header, rec = get_cached_digest(ctx, nonce); /* Check to see if we're stale */ - if((expiry + ctx->cache_timeout) <= time(NULL)) + if((expiry + ctx->opts->cache_timeout) <= time(NULL)) { + ha_messagex(LOG_INFO, "simple: nonce expired, sending stale challenge: %s", + dg.username); + stale = 1; goto finally; } if(!rec) { + ha_messagex(LOG_INFO, "simple: no record in cache, creating one: %s", dg.username); + /* * If we're valid but don't have a record in the * cache then complete the record properly. @@ -513,7 +526,8 @@ static int simple_digest_response(simple_context_t* ctx, const char* header, /* Increment our nonce count */ rec->nc++; - ret = digest_check(ctx->realm, method, uri, buf, &dg, rec); + ret = digest_check(ctx->opts->realm, method, + ctx->opts->digest_ignoreuri ? NULL : uri, buf, &dg, rec); if(ret == HA_BADREQ) { @@ -527,8 +541,12 @@ static int simple_digest_response(simple_context_t* ctx, const char* header, resp->detail = dg.username; /* Figure out if we need a new nonce */ - if((expiry + (ctx->cache_timeout - (ctx->cache_timeout / 8))) < time(NULL)) + if((expiry + (ctx->opts->cache_timeout - + (ctx->opts->cache_timeout / 8))) < time(NULL)) { + ha_messagex(LOG_INFO, "simple: nonce almost expired, creating new one: %s", + dg.username); + digest_makenonce(nonce, g_simple_secret, NULL); stale = 1; } @@ -543,6 +561,8 @@ static int simple_digest_response(simple_context_t* ctx, const char* header, if(t[0]) ha_addheader(resp, "Authentication-Info", t); + ha_messagex(LOG_NOTICE, "simple: validated digest user: %s", dg.username); + /* Put the connection into the cache */ if((r = save_cached_digest(ctx, rec)) < 0) ret = r; @@ -580,26 +600,6 @@ int simple_config(ha_context_t* context, const char* name, const char* value) return HA_OK; } - else if(strcmp(name, "realm") == 0) - { - ctx->realm = value; - return HA_OK; - } - - else if(strcmp(name, "digestdomains") == 0) - { - ctx->domains = value; - return HA_OK; - } - -#ifdef _DEBUG - else if(strcmp(name, "digestdebugnonce") == 0) - { - ctx->debug_nonce = value; - return HA_OK; - } -#endif - return HA_FALSE; } @@ -608,6 +608,7 @@ int simple_init(ha_context_t* context) /* Global initialization */ if(!context) { + ha_messagex(LOG_DEBUG, "simple: generating secret"); return ha_genrandom(g_simple_secret, DIGEST_SECRET_LEN); } @@ -620,9 +621,9 @@ int simple_init(ha_context_t* context) ASSERT(ctx); /* Make sure there are some types of authentication we can do */ - if(!(context->types & (HA_TYPE_BASIC | HA_TYPE_DIGEST))) + if(!(context->opts.types & (HA_TYPE_BASIC | HA_TYPE_DIGEST))) { - ha_messagex(LOG_ERR, "Simple module configured, but does not implement any " + ha_messagex(LOG_ERR, "simple: module configured, but does not implement any " "configured authentication type."); return HA_FAILED; } @@ -631,7 +632,7 @@ int simple_init(ha_context_t* context) /* Check to make sure the file exists */ if(!ctx->filename) { - ha_messagex(LOG_ERR, "Basic configuration incomplete. " + ha_messagex(LOG_ERR, "simple: configuration incomplete. " "Must have a PasswordFile configured."); return HA_FAILED; } @@ -639,7 +640,7 @@ int simple_init(ha_context_t* context) fd = open(ctx->filename, O_RDONLY); if(fd == -1) { - ha_message(LOG_ERR, "can't open file for simple authentication: %s", ctx->filename); + ha_message(LOG_ERR, "simple: can't open file for authentication: %s", ctx->filename); return HA_FAILED; } @@ -655,9 +656,9 @@ int simple_init(ha_context_t* context) } /* Copy some settings over for easy access */ - ctx->cache_max = context->cache_max; - ctx->cache_timeout = context->cache_timeout; + ctx->opts = &(context->opts); + ha_messagex(LOG_INFO, "simple: initialized handler"); } return HA_OK; @@ -673,6 +674,8 @@ void simple_destroy(ha_context_t* context) if(ctx->cache) hash_free(ctx->cache); + + ha_messagex(LOG_INFO, "simple: uninitialized handler"); } } @@ -684,6 +687,7 @@ int simple_process(ha_context_t* context, ha_request_t* req, int ret = HA_FALSE; int found = 0; basic_header_t basic; + int r; ASSERT(context && req && resp && buf); ASSERT(req->args[AUTH_ARG_METHOD]); @@ -692,21 +696,24 @@ int simple_process(ha_context_t* context, ha_request_t* req, ha_lock(NULL); /* Purge the cache */ - hash_purge(ctx->cache, time(NULL) - ctx->cache_timeout); + r = hash_purge(ctx->cache, time(NULL) - ctx->opts->cache_timeout); ha_unlock(NULL); + if(r > 0) + ha_messagex(LOG_DEBUG, "simple: purged cache records: %d", r); /* We use this below to detect whether to send a default response */ resp->code = -1; /* Check the headers and see if we got a response thingy */ - if(context->types & HA_TYPE_DIGEST) + if(context->opts.types & HA_TYPE_DIGEST) { header = ha_getheader(req, "Authorization", HA_PREFIX_DIGEST); if(header) { + ha_messagex(LOG_DEBUG, "simple: processing digest auth header"); ret = simple_digest_response(ctx, header, req->args[AUTH_ARG_METHOD], req->args[AUTH_ARG_URI], resp, buf); if(ret < 0) @@ -715,8 +722,9 @@ int simple_process(ha_context_t* context, ha_request_t* req, } /* Or a basic authentication */ - if(!header && context->types & HA_TYPE_BASIC) + if(!header && context->opts.types & HA_TYPE_BASIC) { + ha_messagex(LOG_DEBUG, "simple: processing basic auth header"); header = ha_getheader(req, "Authorization", HA_PREFIX_BASIC); if(header) { @@ -732,17 +740,18 @@ int simple_process(ha_context_t* context, ha_request_t* req, { resp->code = HA_SERVER_DECLINE; - if(context->types & HA_TYPE_BASIC) + if(context->opts.types & HA_TYPE_BASIC) { - ha_bufmcat(buf, "BASIC realm=\"", ctx->realm , "\"", NULL); + ha_bufmcat(buf, "BASIC realm=\"", ctx->opts->realm , "\"", NULL); if(ha_buferr(buf)) return HA_CRITERROR; ha_addheader(resp, "WWW-Authenticate", ha_bufdata(buf)); + ha_messagex(LOG_DEBUG, "simple: sent basic auth request"); } - if(context->types & HA_TYPE_DIGEST) + if(context->opts.types & HA_TYPE_DIGEST) { ret = simple_digest_challenge(ctx, resp, buf, 0); if(ret < 0) -- cgit v1.2.3