modules/aaa/mod_authz_dbm.c

   1 /* Licensed to the Apache Software Foundation (ASF) under one or more
   2  * contributor license agreements.  See the NOTICE file distributed with
   3  * this work for additional information regarding copyright ownership.
   4  * The ASF licenses this file to You under the Apache License, Version 2.0
   5  * (the "License"); you may not use this file except in compliance with
   6  * the License.  You may obtain a copy of the License at
   7  *
   8  *     http://www.apache.org/licenses/LICENSE-2.0
   9  *
  10  * Unless required by applicable law or agreed to in writing, software
  11  * distributed under the License is distributed on an "AS IS" BASIS,
  12  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  13  * See the License for the specific language governing permissions and
  14  * limitations under the License.
  15  */
  16
  17 #define APR_WANT_STRFUNC
  18 #include "apr_want.h"
  19 #include "apr_strings.h"
  20 #include "apr_dbm.h"
  21 #include "apr_md5.h"
  22
  23 #include "httpd.h"
  24 #include "http_config.h"
  25 #include "ap_provider.h"
  26 #include "http_core.h"
  27 #include "http_log.h"
  28 #include "http_protocol.h"
  29 #include "http_request.h"   /* for ap_hook_(check_user_id | auth_checker)*/
  30
  31 #include "mod_auth.h"
  32
  33 typedef struct {
  34     char *grpfile;
  35     char *dbmtype;
  36 } authz_dbm_config_rec;
  37
  38 APR_DECLARE_OPTIONAL_FN(char*, authz_owner_get_file_group, (request_rec *r));
  39
  40
  41 /* This should go into APR; perhaps with some nice
  42  * caching/locking/flocking of the open dbm file.
  43  */
  44 static char *get_dbm_entry_as_str(apr_pool_t *pool, apr_dbm_t *f, char *key)
  45 {
  46     apr_datum_t d, q;
  47     q.dptr = key;
  48
  49 #ifndef NETSCAPE_DBM_COMPAT
  50     q.dsize = strlen(q.dptr);
  51 #else
  52     q.dsize = strlen(q.dptr) + 1;
  53 #endif
  54
  55     if (apr_dbm_fetch(f, q, &d) == APR_SUCCESS && d.dptr) {
  56         return apr_pstrmemdup(pool, d.dptr, d.dsize);
  57     }
  58
  59     return NULL;
  60 }
  61
  62 static void *create_authz_dbm_dir_config(apr_pool_t *p, char *d)
  63 {
  64     authz_dbm_config_rec *conf = apr_palloc(p, sizeof(*conf));
  65
  66     conf->grpfile = NULL;
  67     conf->dbmtype = "default";
  68
  69     return conf;
  70 }
  71
  72 static const command_rec authz_dbm_cmds[] =
  73 {
  74     AP_INIT_TAKE1("AuthDBMGroupFile", ap_set_file_slot,
  75      (void *)APR_OFFSETOF(authz_dbm_config_rec, grpfile),
  76      OR_AUTHCFG, "database file containing group names and member user IDs"),
  77     AP_INIT_TAKE1("AuthzDBMType", ap_set_string_slot,
  78      (void *)APR_OFFSETOF(authz_dbm_config_rec, dbmtype),
  79      OR_AUTHCFG, "what type of DBM file the group file is"),
  80     {NULL}
  81 };
  82
  83 module AP_MODULE_DECLARE_DATA authz_dbm_module;
  84
  85 /* We do something strange with the group file.  If the group file
  86  * contains any : we assume the format is
  87  *      key=username value=":"groupname [":"anything here is ignored]
  88  * otherwise we now (0.8.14+) assume that the format is
  89  *      key=username value=groupname
  90  * The first allows the password and group files to be the same
  91  * physical DBM file;   key=username value=password":"groupname[":"anything]
  92  *
  93  * mark@telescope.org, 22Sep95
  94  */
  95
  96 static apr_status_t get_dbm_grp(request_rec *r, char *key1, char *key2,
  97                                 char *dbmgrpfile, char *dbtype,
  98                                 const char ** out)
  99 {
 100     char *grp_colon, *val;
 101     apr_status_t retval;
 102     apr_dbm_t *f;
 103
 104     retval = apr_dbm_open_ex(&f, dbtype, dbmgrpfile, APR_DBM_READONLY,
 105                              APR_OS_DEFAULT, r->pool);
 106
 107     if (retval != APR_SUCCESS) {
 108         return retval;
 109     }
 110
 111     /* Try key2 only if key1 failed */
 112     if (!(val = get_dbm_entry_as_str(r->pool, f, key1))) {
 113         val = get_dbm_entry_as_str(r->pool, f, key2);
 114     }
 115
 116     apr_dbm_close(f);
 117
 118     if (val && (grp_colon = ap_strchr(val, ':')) != NULL) {
 119         char *grp_colon2 = ap_strchr(++grp_colon, ':');
 120
 121         if (grp_colon2) {
 122             *grp_colon2 = '\0';
 123         }
 124         *out = grp_colon;
 125     }
 126     else {
 127         *out = val;
 128     }
 129
 130     return retval;
 131 }
 132
 133 static authz_status dbmgroup_check_authorization(request_rec *r,
 134                                              const char *require_args)
 135 {
 136     authz_dbm_config_rec *conf = ap_get_module_config(r->per_dir_config,
 137                                                       &authz_dbm_module);
 138     char *user = r->user;
 139     const char *t;
 140     char *w;
 141     const char *orig_groups = NULL;
 142     const char *realm = ap_auth_name(r);
 143     const char *groups;
 144     char *v;
 145
 146     if (!user) {
 147         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 148             "access to %s failed, reason: no authenticated user", r->uri);
 149         return AUTHZ_DENIED;
 150     }
 151
 152     if (!conf->grpfile) {
 153         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 154                         "No group file was specified in the configuration");
 155         return AUTHZ_DENIED;
 156     }
 157
 158     /* fetch group data from dbm file only once. */
 159     if (!orig_groups) {
 160         apr_status_t status;
 161
 162         status = get_dbm_grp(r, apr_pstrcat(r->pool, user, ":", realm, NULL),
 163                              user, conf->grpfile, conf->dbmtype, &groups);
 164
 165         if (status != APR_SUCCESS) {
 166             ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
 167                           "could not open dbm (type %s) group access "
 168                           "file: %s", conf->dbmtype, conf->grpfile);
 169             return AUTHZ_GENERAL_ERROR;
 170         }
 171
 172         if (groups == NULL) {
 173             /* no groups available, so exit immediately */
 174             ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 175                           "Authorization of user %s to access %s failed, reason: "
 176                           "user doesn't appear in DBM group file (%s).",
 177                           r->user, r->uri, conf->grpfile);
 178             return AUTHZ_DENIED;
 179         }
 180
 181         orig_groups = groups;
 182     }
 183
 184     t = require_args;
 185     while ((w = ap_getword_white(r->pool, &t)) && w[0]) {
 186         groups = orig_groups;
 187         while (groups[0]) {
 188             v = ap_getword(r->pool, &groups, ',');
 189             if (!strcmp(v, w)) {
 190                 return AUTHZ_GRANTED;
 191             }
 192         }
 193     }
 194
 195     ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 196                   "Authorization of user %s to access %s failed, reason: "
 197                   "user is not part of the 'require'ed group(s).",
 198                   r->user, r->uri);
 199
 200     return AUTHZ_DENIED;
 201 }
 202
 203 APR_OPTIONAL_FN_TYPE(authz_owner_get_file_group) *authz_owner_get_file_group;
 204
 205 static authz_status dbmfilegroup_check_authorization(request_rec *r,
 206                                               const char *require_args)
 207 {
 208     authz_dbm_config_rec *conf = ap_get_module_config(r->per_dir_config,
 209                                                       &authz_dbm_module);
 210     char *user = r->user;
 211     const char *realm = ap_auth_name(r);
 212     const char *filegroup = NULL;
 213     const char *orig_groups = NULL;
 214     apr_status_t status;
 215     const char *groups;
 216     char *v;
 217
 218     if (!user) {
 219         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 220             "access to %s failed, reason: no authenticated user", r->uri);
 221         return AUTHZ_DENIED;
 222     }
 223
 224     if (!conf->grpfile) {
 225         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 226                         "No group file was specified in the configuration");
 227         return AUTHZ_DENIED;
 228     }
 229
 230     /* fetch group data from dbm file. */
 231     status = get_dbm_grp(r, apr_pstrcat(r->pool, user, ":", realm, NULL),
 232                          user, conf->grpfile, conf->dbmtype, &groups);
 233
 234     if (status != APR_SUCCESS) {
 235         ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,
 236                       "could not open dbm (type %s) group access "
 237                       "file: %s", conf->dbmtype, conf->grpfile);
 238         return AUTHZ_DENIED;
 239     }
 240
 241     if (groups == NULL) {
 242         /* no groups available, so exit immediately */
 243         ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 244                       "Authorization of user %s to access %s failed, reason: "
 245                       "user doesn't appear in DBM group file (%s).",
 246                       r->user, r->uri, conf->grpfile);
 247         return AUTHZ_DENIED;
 248     }
 249
 250     orig_groups = groups;
 251
 252     filegroup = authz_owner_get_file_group(r);
 253
 254     if (filegroup) {
 255         groups = orig_groups;
 256         while (groups[0]) {
 257             v = ap_getword(r->pool, &groups, ',');
 258             if (!strcmp(v, filegroup)) {
 259                 return AUTHZ_GRANTED;
 260             }
 261         }
 262     }
 263
 264     ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
 265                   "Authorization of user %s to access %s failed, reason: "
 266                   "user is not part of the 'require'ed group(s).",
 267                   r->user, r->uri);
 268
 269     return AUTHZ_DENIED;
 270 }
 271
 272 static const authz_provider authz_dbmgroup_provider =
 273 {
 274     &dbmgroup_check_authorization,
 275 };
 276
 277 static const authz_provider authz_dbmfilegroup_provider =
 278 {
 279     &dbmfilegroup_check_authorization,
 280 };
 281
 282
 283 static void register_hooks(apr_pool_t *p)
 284 {
 285     authz_owner_get_file_group = APR_RETRIEVE_OPTIONAL_FN(authz_owner_get_file_group);
 286
 287     ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "dbm-group",
 288                               AUTHZ_PROVIDER_VERSION,
 289                               &authz_dbmgroup_provider,
 290                               AP_AUTH_INTERNAL_PER_CONF);
 291     ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "dbm-file-group",
 292                               AUTHZ_PROVIDER_VERSION,
 293                               &authz_dbmfilegroup_provider,
 294                               AP_AUTH_INTERNAL_PER_CONF);
 295 }
 296
 297 module AP_MODULE_DECLARE_DATA authz_dbm_module =
 298 {
 299     STANDARD20_MODULE_STUFF,
 300     create_authz_dbm_dir_config, /* dir config creater */
 301     NULL,                        /* dir merger --- default is to override */
 302     NULL,                        /* server config */
 303     NULL,                        /* merge server config */
 304     authz_dbm_cmds,              /* command apr_table_t */
 305     register_hooks               /* register hooks */
 306 };