/* ====================================================================
* The Apache Software License, Version 1.1
*
* Copyright (c) 2000-2002 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* the documentation and/or other materials provided with the
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Apache" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
* .
*
* Portions of this software are based upon public domain software
* originally written at the National Center for Supercomputing Applications,
* University of Illinois, Urbana-Champaign.
*/
/*
* http_auth: authentication
*
* Rob McCool & Brian Behlendorf.
*
* Adapted to Apache by rst.
*
* dirkx - Added Authoritative control to allow passing on to lower
* modules if and only if the userid is not known to this
* module. A known user with a faulty or absent password still
* causes an AuthRequired. The default is 'Authoritative', i.e.
* no control is passed along.
*/
#define APR_WANT_STRFUNC
#include "apr_want.h"
#include "apr_strings.h"
#include "apr_network_io.h"
#include "apr_errno.h"
#include "apr_general.h"
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h" /* for ap_hook_(check_user_id | auth_checker) */
#define DBG0(f) ap_log_error(APLOG_MARK, \
APLOG_ERR, 0, NULL, (f))
#define DBG1(f,a1) ap_log_error(APLOG_MARK, \
APLOG_ERR, 0, NULL, f, a1)
#define DBG2(f,a1,a2) ap_log_error(APLOG_MARK, \
APLOG_ERR, 0, NULL, f, a1, a2)
#define DBG3(f,a1,a2,a3) ap_log_error(APLOG_MARK, \
APLOG_ERR, 0, NULL, f, a1, a2, a3)
#define TRACE() DBG0("- TRACE :" __FUNCTION__ )
typedef struct
{
const char *url;
} mailman_auth_config_rec;
extern module AP_MODULE_DECLARE_DATA auth_mailman_module;
static void *create_mailman_auth_dir_config(apr_pool_t * p, char *d)
{
mailman_auth_config_rec *conf = apr_pcalloc(p, sizeof(*conf));
return conf;
}
static const char *mailman_set_url(cmd_parms * cmd,
void *dir_config, const char *arg)
{
mailman_auth_config_rec *conf = dir_config;
conf->url = apr_pstrdup(cmd->pool, arg);
return NULL;
}
static const command_rec mailman_auth_cmds[] = {
AP_INIT_TAKE1("AuthMailmanURL", mailman_set_url, NULL,
OR_AUTHCFG, "Mailman URL"),
{ NULL }
};
static int mailman_check_passwd(request_rec *r,
apr_pool_t *pool, const char *uri,
const char *user, const char *pass)
{
int len;
char buf[1024];
const char *post_uri, *post_value;
struct apr_uri_t uptr;
apr_socket_t *sock;
apr_sockaddr_t *sockaddr;
apr_status_t stat;
if (apr_uri_parse(pool, uri, &uptr) != APR_SUCCESS) {
DBG0("Malformed Mailman URL");
return HTTP_UNAUTHORIZED;
}
post_value = apr_psprintf(pool, "othersubspw=%s&othersubs=List\n", pass);
post_uri = apr_psprintf(pool, "POST %s/%s HTTP/1.1\n"
"Content-length: %d\n"
"Connection: close\n"
"Host: %s\n\n",
uptr.path, user,
strlen(post_value), uptr.hostname);
stat = apr_socket_create(&sock, APR_INET, SOCK_STREAM, pool);
if (stat != APR_SUCCESS) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, stat, r,
"auth_mailman: failed to create a socket");
return HTTP_UNAUTHORIZED;
}
stat = apr_sockaddr_info_get(&sockaddr, uptr.hostname, APR_INET,
uptr.port == 0 ? 80 : uptr.port, 0, pool);
if (stat != APR_SUCCESS) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, stat, r,
"auth_mailman: apr_sockaddr_info_get() failed");
return HTTP_UNAUTHORIZED;
}
stat = apr_connect(sock, sockaddr);
if (stat != APR_SUCCESS) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, stat, r,
"auth_mailman: apr_connect() failed");
return HTTP_UNAUTHORIZED;
}
len = strlen(post_uri);
stat = apr_send(sock, post_uri, &len);
if (stat != APR_SUCCESS) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, stat, r,
"auth_mailman: apr_send() of header failed");
return HTTP_UNAUTHORIZED;
}
len = strlen(post_value);
stat = apr_send(sock, post_value, &len);
if (stat != APR_SUCCESS) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, stat, r,
"auth_mailman: apr_send() of body failed");
return HTTP_UNAUTHORIZED;
}
/* Read Once is enough */
len = sizeof(buf) - 1;
apr_recv(sock, buf, &len);
buf[len] = 0;
/*
DBG1("READ: %s", buf);
*/
/* If we can see this things */
if (strstr(buf, "List Subscriptions "))
return OK;
return HTTP_UNAUTHORIZED;
}
static int mailman_authenticate_basic_user(request_rec * r)
{
mailman_auth_config_rec *conf = ap_get_module_config(r->per_dir_config,
&auth_mailman_module);
const char *sent_pw;
int res;
/* bail quickly if we aren't configured to do the auth */
if (conf->url == NULL)
return DECLINED;
if ((res = ap_get_basic_auth_pw(r, &sent_pw)))
return res;
if (mailman_check_passwd(r, r->pool, conf->url, r->user, sent_pw) != OK) {
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
"Mailman user %s: authentication failure for \"%s\": "
"Password Mismatch", r->user, r->uri);
ap_note_basic_auth_failure(r);
return HTTP_UNAUTHORIZED;
}
return OK;
}
static void register_hooks(apr_pool_t * p)
{
ap_hook_check_user_id(mailman_authenticate_basic_user, NULL, NULL,
APR_HOOK_MIDDLE);
}
module AP_MODULE_DECLARE_DATA auth_mailman_module = {
STANDARD20_MODULE_STUFF,
create_mailman_auth_dir_config, /* dir config creater */
NULL, /* dir merger --- default is to override */
NULL, /* server config */
NULL, /* merge server config */
mailman_auth_cmds, /* command apr_table_t */
register_hooks /* register hooks */
};