From owner-svn-ports-all@FreeBSD.ORG Tue Jun 18 20:46:02 2013 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id 38D3AD6E; Tue, 18 Jun 2013 20:46:02 +0000 (UTC) (envelope-from ohauer@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 2A73F1263; Tue, 18 Jun 2013 20:46:02 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r5IKk2ci006619; Tue, 18 Jun 2013 20:46:02 GMT (envelope-from ohauer@svn.freebsd.org) Received: (from ohauer@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r5IKk1lq006617; Tue, 18 Jun 2013 20:46:01 GMT (envelope-from ohauer@svn.freebsd.org) Message-Id: <201306182046.r5IKk1lq006617@svn.freebsd.org> From: Olli Hauer Date: Tue, 18 Jun 2013 20:46:01 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r321221 - in head/www/mod_auth_kerb2: . files X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jun 2013 20:46:02 -0000 Author: ohauer Date: Tue Jun 18 20:46:01 2013 New Revision: 321221 URL: http://svnweb.freebsd.org/changeset/ports/321221 Log: - patch mod_auth_kerb.c from r150 to r157 from upstream repo Special thanks to Hiroki Sato (hrs@) for testing the patch! with had apache@ Obtained from: http://modauthkerb.cvs.sourceforge.net/viewvc/modauthkerb/mod_auth_kerb/src/mod_auth_kerb.c?revision=1.157 Added: head/www/mod_auth_kerb2/files/patch-src__mod_auth_kerb.c (contents, props changed) Modified: head/www/mod_auth_kerb2/Makefile Modified: head/www/mod_auth_kerb2/Makefile ============================================================================== --- head/www/mod_auth_kerb2/Makefile Tue Jun 18 20:08:36 2013 (r321220) +++ head/www/mod_auth_kerb2/Makefile Tue Jun 18 20:46:01 2013 (r321221) @@ -3,7 +3,7 @@ PORTNAME= mod_auth_kerb PORTVERSION= 5.4 -PORTREVISION= 4 +PORTREVISION= 5 CATEGORIES= www MASTER_SITES= SF/modauthkerb/${PORTNAME}/${PORTNAME}-${PORTVERSION} PKGNAMEPREFIX= ${APACHE_PKGNAMEPREFIX} Added: head/www/mod_auth_kerb2/files/patch-src__mod_auth_kerb.c ============================================================================== --- /dev/null 00:00:00 1970 (empty, because file is newly added) +++ head/www/mod_auth_kerb2/files/patch-src__mod_auth_kerb.c Tue Jun 18 20:46:01 2013 (r321221) @@ -0,0 +1,389 @@ +# Latest revision in mod_auth_kerb repo is r157 from from 2009-08-11 +# Rev in latest src archive is r150. +# http://modauthkerb.cvs.sourceforge.net/viewvc/modauthkerb/mod_auth_kerb/src/mod_auth_kerb.c?revision=1.157 +============================================================================================================ +--- ./src/mod_auth_kerb.c.orig 2008-12-04 11:14:03.000000000 +0100 ++++ ./src/mod_auth_kerb.c 2013-06-18 17:06:05.000000000 +0200 +@@ -11,6 +11,12 @@ + */ + + /* ++ * This file reflects r157 which is not released but contains some fixes ++ * http://modauthkerb.cvs.sourceforge.net/viewvc/modauthkerb/mod_auth_kerb/src/mod_auth_kerb.c?revision=1.157 ++ * ++ */ ++ ++/* + * Copyright (c) 2004-2006 Masarykova universita + * (Masaryk University, Brno, Czech Republic) + * All rights reserved. +@@ -42,7 +48,7 @@ + * POSSIBILITY OF SUCH DAMAGE. + */ + +-#ident "$Id: mod_auth_kerb.c,v 1.150 2008/12/04 10:14:03 baalberith Exp $" ++#ident "$Id: mod_auth_kerb.c,v 1.157 2009/08/11 07:37:27 kouril Exp $" + + #include "config.h" + +@@ -80,6 +86,11 @@ + #define apr_pool_cleanup_register ap_register_cleanup + #endif /* STANDARD20_MODULE_STUFF */ + ++#if AP_SERVER_MAJORVERSION_NUMBER == 2 && AP_SERVER_MINORVERSION_NUMBER== 2 ++#define APACHE22 ++#include "mod_auth.h" ++#endif ++ + #ifdef _WIN32 + #define vsnprintf _vsnprintf + #define snprintf _snprintf +@@ -88,7 +99,7 @@ + #ifdef KRB5 + #include + #ifdef HEIMDAL +-# include ++# include + #else + # include + # include +@@ -298,7 +309,7 @@ + } + + /* And this is the operations vector for our replay cache */ +-const krb5_rc_ops_internal mod_auth_kerb_rc_ops = { ++static const krb5_rc_ops_internal mod_auth_kerb_rc_ops = { + 0, + "dfl", + krb5_rc_dfl_init, +@@ -329,7 +340,7 @@ + ((kerb_auth_config *)rec)->krb_ssl_preauthentication = 0; + #endif + #ifdef KRB5 +- ((kerb_auth_config *)rec)->krb5_do_auth_to_local = 0; ++ ((kerb_auth_config *)rec)->krb5_do_auth_to_local = 0; + ((kerb_auth_config *)rec)->krb_method_k5pass = 1; + ((kerb_auth_config *)rec)->krb_method_gssapi = 1; + #endif +@@ -527,7 +538,7 @@ + user = apr_pstrcat(r->pool, user, "@", realm, NULL); + + MK_USER = user; +- MK_AUTH_TYPE = "Basic"; ++ MK_AUTH_TYPE = "Kerberos"; + apr_table_setn(r->subprocess_env, "KRBTKFILE", tkt_file_p); + + if (!conf->krb_save_credentials) +@@ -677,7 +688,8 @@ + static krb5_error_code + verify_krb5_user(request_rec *r, krb5_context context, krb5_principal principal, + const char *password, krb5_principal server, +- krb5_keytab keytab, int krb_verify_kdc, char *krb_service_name, krb5_ccache *ccache) ++ krb5_keytab keytab, int krb_verify_kdc, ++ const char *krb_service_name, krb5_ccache *ccache) + { + krb5_creds creds; + krb5_get_init_creds_opt options; +@@ -926,7 +938,6 @@ + return OK; + } + +- + static int + authenticate_user_krb5pwd(request_rec *r, + kerb_auth_config *conf, +@@ -1061,7 +1072,7 @@ + goto end; + } + MK_USER = apr_pstrdup (r->pool, name); +- MK_AUTH_TYPE = "Basic"; ++ MK_AUTH_TYPE = "Kerberos"; + free(name); + + if (conf->krb_save_credentials) +@@ -1280,6 +1291,7 @@ + return 0; + } + ++#ifndef GSSAPI_SUPPORTS_SPNEGO + static int + cmp_gss_type(gss_buffer_t token, gss_OID oid) + { +@@ -1306,6 +1318,7 @@ + + return memcmp(p, oid->elements, oid->length); + } ++#endif + + static int + authenticate_user_gss(request_rec *r, kerb_auth_config *conf, +@@ -1438,15 +1451,15 @@ + goto end; + } + +-#if 0 +- /* This is a _Kerberos_ module so multiple authentication rounds aren't +- * supported. If we wanted a generic GSS authentication we would have to do +- * some magic with exporting context etc. */ ++ /* Multiple authentication rounds aren't supported. If we wanted a generic ++ * GSS authentication we would have to do some magic with exporting context ++ * etc. */ + if (major_status & GSS_S_CONTINUE_NEEDED) { ++ log_rerror(APLOG_MARK, APLOG_ERR, 0, r, ++ "Multi-iteration authentication isn't supported"); + ret = HTTP_UNAUTHORIZED; + goto end; + } +-#endif + + major_status = gss_display_name(&minor_status, client_name, &output_token, NULL); + gss_release_name(&minor_status, &client_name); +@@ -1549,11 +1562,11 @@ + #endif /* KRB5 */ + + static krb5_conn_data * +-already_succeeded(request_rec *r, char *auth_line) ++already_authorized(request_rec *r, char *auth_line) + { + krb5_conn_data *conn_data; + char keyname[1024]; +- ++ + snprintf(keyname, sizeof(keyname) - 1, + "mod_auth_kerb::connection::%s::%ld", r->connection->remote_ip, + r->connection->id); +@@ -1571,6 +1584,24 @@ + } + + static void ++save_authorized(request_rec *r, char *auth_line, const char *auth_type, int ret) { ++ krb5_conn_data *prevauth; ++ prevauth = (krb5_conn_data *)apr_palloc(r->connection->pool, sizeof(krb5_conn_data)); ++ ++ char keyname[1024]; ++ ++ prevauth->user = apr_pstrdup(r->connection->pool, MK_USER); ++ prevauth->authline = apr_pstrdup(r->connection->pool, auth_line); ++ prevauth->mech = apr_pstrdup(r->connection->pool, auth_type); ++ prevauth->last_return = ret; ++ ++ snprintf(keyname, sizeof(keyname) - 1, ++ "mod_auth_kerb::connection::%s::%ld", ++ r->connection->remote_ip, r->connection->id); ++ apr_pool_userdata_set(prevauth, keyname, NULL, r->connection->pool); ++} ++ ++static void + set_kerb_auth_headers(request_rec *r, const kerb_auth_config *conf, + int use_krb4, int use_krb5pwd, char *negotiate_ret_value) + { +@@ -1607,51 +1638,16 @@ + } + + static int +-kerb_authenticate_user(request_rec *r) ++authenticate_user(request_rec *r, char *auth_line, const char *type, int use_krb4, int use_krb5) + { +- kerb_auth_config *conf = +- (kerb_auth_config *) ap_get_module_config(r->per_dir_config, +- &auth_kerb_module); +- krb5_conn_data *prevauth = NULL; +- const char *auth_type = NULL; +- char *auth_line = NULL; +- const char *type = NULL; +- int use_krb5 = 0, use_krb4 = 0; + int ret; +- static int last_return = HTTP_UNAUTHORIZED; ++ krb5_conn_data *prevauth = NULL; ++ kerb_auth_config *conf = ++ (kerb_auth_config *) ap_get_module_config(r->per_dir_config, ++ &auth_kerb_module); + char *negotiate_ret_value = NULL; +- char keyname[1024]; +- +- /* get the type specified in .htaccess */ +- type = ap_auth_type(r); +- +- log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, +- "kerb_authenticate_user entered with user %s and auth_type %s", +- (MK_USER)?MK_USER:"(NULL)",type?type:"(NULL)"); +- +- if (type && strcasecmp(type, "Kerberos") == 0) +- use_krb5 = use_krb4 = 1; +- else if(type && strcasecmp(type, "KerberosV5") == 0) +- use_krb5 = 1; +- else if(type && strcasecmp(type, "KerberosV4") == 0) +- use_krb4 = 1; +- else +- return DECLINED; +- +-#if 0 +- if (conf->krb_ssl_preauthentication) { +- const char *ssl_client_verify = ssl_var_lookup(r->pool, r->server, +- r->connection, r, "SSL_CLIENT_VERIFY"); +- +- if (ssl_client_verify && strcmp(ssl_client_verify, "SUCCESS") == 0) +- return OK; +- } +-#endif +- +- /* get what the user sent us in the HTTP header */ +- auth_line = (char *)MK_TABLE_GET(r->headers_in, (r->proxyreq == PROXYREQ_PROXY) +- ? "Proxy-Authorization" +- : "Authorization"); ++ const char *auth_type = NULL; ++ + if (!auth_line) { + set_kerb_auth_headers(r, conf, use_krb4, use_krb5, + (use_krb5) ? "\0" : NULL); +@@ -1669,60 +1665,108 @@ + #endif + (strcasecmp(auth_type, "Basic") == 0)) + return DECLINED; +- +- if ( (prevauth = already_succeeded(r, auth_line)) == NULL) { +- ret = HTTP_UNAUTHORIZED; ++ if ((prevauth = already_authorized(r, auth_line)) == NULL) { ++ ret = HTTP_UNAUTHORIZED; + + #ifdef KRB5 + if (use_krb5 && conf->krb_method_gssapi && + strcasecmp(auth_type, MECH_NEGOTIATE) == 0) { + ret = authenticate_user_gss(r, conf, auth_line, &negotiate_ret_value); +- } else if (use_krb5 && conf->krb_method_k5pass && +- strcasecmp(auth_type, "Basic") == 0) { ++ } else if (use_krb5 && (conf->krb_method_k5pass || strcasecmp(type, "Basic"))){ + ret = authenticate_user_krb5pwd(r, conf, auth_line); + } + #endif + + #ifdef KRB4 +- if (ret == HTTP_UNAUTHORIZED && use_krb4 && conf->krb_method_k4pass && +- strcasecmp(auth_type, "Basic") == 0) ++ if (ret == HTTP_UNAUTHORIZED && use_krb4 && (conf->krb_method_k4pass || strcasecmp(type, "Basic"))) + ret = authenticate_user_krb4pwd(r, conf, auth_line); + #endif + +- if (ret == HTTP_UNAUTHORIZED) +- set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value); ++ if (ret == HTTP_UNAUTHORIZED) ++ set_kerb_auth_headers(r, conf, use_krb4, use_krb5, negotiate_ret_value); + + } else { +- ret = prevauth->last_return; +- MK_USER = prevauth->user; +- MK_AUTH_TYPE = prevauth->mech; ++ ret = prevauth->last_return; ++ MK_USER = prevauth->user; ++ MK_AUTH_TYPE = prevauth->mech; + } + + /* + * save who was auth'd, if it's not already stashed. + */ +- if(!prevauth) { +- prevauth = (krb5_conn_data *) apr_pcalloc(r->connection->pool, sizeof(krb5_conn_data)); +- prevauth->user = apr_pstrdup(r->connection->pool, MK_USER); +- prevauth->authline = apr_pstrdup(r->connection->pool, auth_line); +- prevauth->mech = apr_pstrdup(r->connection->pool, auth_type); +- prevauth->last_return = ret; +- snprintf(keyname, sizeof(keyname) - 1, +- "mod_auth_kerb::connection::%s::%ld", +- r->connection->remote_ip, r->connection->id); +- apr_pool_userdata_set(prevauth, keyname, NULL, r->connection->pool); ++ if(!prevauth) { ++ save_authorized(r, auth_line, auth_type, ret); + } + +- if (ret == OK && conf->krb5_do_auth_to_local) +- ret = do_krb5_an_to_ln(r); ++ if (ret == OK && conf->krb5_do_auth_to_local) { ++ ret = do_krb5_an_to_ln(r); ++ } ++ return ret; ++} ++ ++static authn_status authn_krb_password(request_rec *r, const char *user, ++ const char *password) ++{ ++ char *auth_line = NULL; ++ int ret; ++ const char *type = NULL; + +- /* XXX log_debug: if ret==OK, log(user XY authenticated) */ ++ type = ap_auth_type(r); ++ auth_line = ap_pbase64encode (r->pool, apr_psprintf(r->pool, "%s:%s", user, password)); ++ auth_line = apr_psprintf(r->pool, "Basic %s", auth_line); ++ ++ ret = authenticate_user(r, auth_line, type, 1, 1); ++ ++ if (ret == OK) return AUTH_GRANTED; ++ else return AUTH_USER_NOT_FOUND; ++} ++ ++static int ++kerb_authenticate_user(request_rec *r) ++{ ++ kerb_auth_config *conf = ++ (kerb_auth_config *) ap_get_module_config(r->per_dir_config, ++ &auth_kerb_module); ++ char *auth_line = NULL; ++ int ret, use_krb4 = 0, use_krb5 = 0; ++ const char *type = NULL; ++ ++ /* get the type specified in .htaccess */ ++ type = ap_auth_type(r); ++ ++ log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r, ++ "kerb_authenticate_user entered with user %s and auth_type %s", ++ (MK_USER)?MK_USER:"(NULL)",type?type:"(NULL)"); ++ ++ if (type && strcasecmp(type, "Kerberos") == 0) ++ use_krb5 = use_krb4 = 1; ++ else if(type && strcasecmp(type, "KerberosV5") == 0) ++ use_krb5 = 1; ++ else if(type && strcasecmp(type, "KerberosV4") == 0) ++ use_krb4 = 1; ++ else ++ return DECLINED; ++ ++#if 0 ++ if (conf->krb_ssl_preauthentication) { ++ const char *ssl_client_verify = ssl_var_lookup(r->pool, r->server, ++ r->connection, r, "SSL_CLIENT_VERIFY"); ++ ++ if (ssl_client_verify && strcmp(ssl_client_verify, "SUCCESS") == 0) ++ return OK; ++ } ++#endif ++ ++ /* get what the user sent us in the HTTP header */ ++ auth_line = (char *)MK_TABLE_GET(r->headers_in, (r->proxyreq == PROXYREQ_PROXY) ++ ? "Proxy-Authorization" ++ : "Authorization"); ++ ret = authenticate_user(r, auth_line, type, use_krb4, use_krb5); + +- last_return = ret; + return ret; + } + +-int ++static int + have_rcache_type(const char *type) + { + krb5_error_code ret; +@@ -1805,6 +1849,14 @@ + static void + kerb_register_hooks(apr_pool_t *p) + { ++#ifdef APACHE22 ++ static const authn_provider authn_krb_provider = { ++ &authn_krb_password, ++ NULL ++ }; ++ ++ ap_register_provider(p, AUTHN_PROVIDER_GROUP, "kerberos", "0", &authn_krb_provider); ++#endif + ap_hook_post_config(kerb_init_handler, NULL, NULL, APR_HOOK_MIDDLE); + ap_hook_check_user_id(kerb_authenticate_user, NULL, NULL, APR_HOOK_MIDDLE); + }