#include "apr_strings.h"
#include "apr_lib.h"
#include "apr_base64.h"
#include "apr_want.h"
#include "ap_config.h"
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
#include "ap_provider.h"
#include "util_md5.h"
#include "ap_expr.h"
#include "mod_auth.h"
#include "mod_session.h"
#include "mod_request.h"

Classes
struct	auth_form_config_rec

Macros
#define	APR_WANT_STRFUNC /* for strcasecmp */

#define	FORM_LOGIN_HANDLER "form-login-handler"

#define	FORM_LOGOUT_HANDLER "form-logout-handler"

#define	FORM_REDIRECT_HANDLER "form-redirect-handler"

#define	MOD_AUTH_FORM_HASH "site"

Functions
static void *	create_auth_form_dir_config (apr_pool_t p, char d)

static void *	merge_auth_form_dir_config (apr_pool_t p, void basev, void *addv)

static const char *	add_authn_provider (cmd_parms cmd, void config, const char *arg)

static const char *	check_string (cmd_parms cmd, const char string)

static const char *	set_cookie_form_location (cmd_parms cmd, void config, const char *location)

static const char *	set_cookie_form_username (cmd_parms cmd, void config, const char *username)

static const char *	set_cookie_form_password (cmd_parms cmd, void config, const char *password)

static const char *	set_cookie_form_method (cmd_parms cmd, void config, const char *method)

static const char *	set_cookie_form_mimetype (cmd_parms cmd, void config, const char *mimetype)

static const char *	set_cookie_form_body (cmd_parms cmd, void config, const char *body)

static const char *	set_cookie_form_size (cmd_parms cmd, void config, const char *arg)

static const char *	set_login_required_location (cmd_parms cmd, void config, const char *loginrequired)

static const char *	set_login_success_location (cmd_parms cmd, void config, const char *loginsuccess)

static const char *	set_logout_location (cmd_parms cmd, void config, const char *logout)

static const char *	set_site_passphrase (cmd_parms cmd, void config, const char *site)

static const char *	set_authoritative (cmd_parms cmd, void config, int flag)

static const char *	set_fake_basic_auth (cmd_parms cmd, void config, int flag)

static const char *	set_disable_no_store (cmd_parms cmd, void config, int flag)

static void	note_cookie_auth_failure (request_rec *r)

static int	hook_note_cookie_auth_failure (request_rec r, const char auth_type)

static void	set_notes_auth (request_rec r, const char user, const char pw, const char method, const char *mimetype)

static void	get_notes_auth (request_rec r, const char user, const char pw, const char method, const char *mimetype)

static apr_status_t	set_session_auth (request_rec r, const char user, const char pw, const char site)

static apr_status_t	get_session_auth (request_rec r, const char user, const char pw, const char *hash)

static int	get_form_auth (request_rec r, const char username, const char password, const char location, const char method, const char mimetype, const char body, const char sent_user, const char sent_pw, const char sent_loc, const char sent_method, const char sent_mimetype, apr_bucket_brigade sent_body, auth_form_config_rec conf)

static int	check_site (request_rec r, const char site, const char sent_user, const char sent_hash)

static int	check_authn (request_rec r, const char sent_user, const char *sent_pw)

static void	fake_basic_authentication (request_rec r, auth_form_config_rec conf, const char user, const char pw)

static int	authenticate_form_authn (request_rec *r)

static int	authenticate_form_login_handler (request_rec *r)

static int	authenticate_form_logout_handler (request_rec *r)

static int	authenticate_form_redirect_handler (request_rec *r)

static int	authenticate_form_post_config (apr_pool_t pconf, apr_pool_t plog, apr_pool_t ptemp, server_rec s)

static void	register_hooks (apr_pool_t *p)

Variables
static apr_OFN_ap_session_load_t *	ap_session_load_fn = NULL

static apr_OFN_ap_session_get_t *	ap_session_get_fn = NULL

static apr_OFN_ap_session_set_t *	ap_session_set_fn = NULL

static void(*	ap_request_insert_filter_fn )(request_rec *r) = NULL

static void(*	ap_request_remove_filter_fn )(request_rec *r) = NULL

static const command_rec	auth_form_cmds []

static int *const	aplog_module_index = &( auth_form_module.module_index)

Macro Definition Documentation

◆ APR_WANT_STRFUNC

#define APR_WANT_STRFUNC /* for strcasecmp */

Definition at line 20 of file mod_auth_form.c.

◆ FORM_LOGIN_HANDLER

#define FORM_LOGIN_HANDLER "form-login-handler"

Definition at line 38 of file mod_auth_form.c.

◆ FORM_LOGOUT_HANDLER

#define FORM_LOGOUT_HANDLER "form-logout-handler"

Definition at line 39 of file mod_auth_form.c.

◆ FORM_REDIRECT_HANDLER

#define FORM_REDIRECT_HANDLER "form-redirect-handler"

Definition at line 40 of file mod_auth_form.c.

◆ MOD_AUTH_FORM_HASH

#define MOD_AUTH_FORM_HASH "site"

Definition at line 41 of file mod_auth_form.c.

Function Documentation

◆ add_authn_provider()

static const char * add_authn_provider	(	cmd_parms *	cmd,
		void *	config,
		const char *	arg
	)

static

Definition at line 144 of file mod_auth_form.c.

◆ authenticate_form_authn()

static int authenticate_form_authn ( request_rec * r )

static

Must we use form authentication? If so, extract the cookie and run the authnz hooks to determine if the login is valid.

If the login is not valid, a 401 Not Authorized will be returned. It is up to the webmaster to ensure this screen displays a suitable login form to give the user the opportunity to log in.

< Module declines to handle

< Standard proxy

< Module has handled this stage.

Definition at line 881 of file mod_auth_form.c.

◆ authenticate_form_login_handler()

static int authenticate_form_login_handler ( request_rec * r )

static

Handle a login attempt.

If the login session is either missing or form authnz is unsuccessful, a 401 Not Authorized will be returned to the browser. The webmaster is expected to insert a login form into the 401 Not Authorized error screen.

If the webmaster wishes, they can point the form submission at this handler, which will redirect the user to the correct page on success. On failure, the 401 Not Authorized error screen will be redisplayed, where the login attempt can be repeated.

< Module declines to handle

< Module has handled this stage.

Definition at line 1112 of file mod_auth_form.c.

◆ authenticate_form_logout_handler()

static int authenticate_form_logout_handler ( request_rec * r )

static

Handle a logout attempt.

If an attempt is made to access this URL, any username and password embedded in the session is deleted.

This has the effect of logging the person out.

If a logout URI has been specified, this function will create an internal redirect to this page.

< Module declines to handle

Definition at line 1192 of file mod_auth_form.c.

◆ authenticate_form_post_config()

static int authenticate_form_post_config	(	apr_pool_t *	pconf,
		apr_pool_t *	plog,
		apr_pool_t *	ptemp,
		server_rec *	s
	)

static

< Module has handled this stage.

Definition at line 1275 of file mod_auth_form.c.

◆ authenticate_form_redirect_handler()

static int authenticate_form_redirect_handler ( request_rec * r )

static

Handle a redirect attempt.

If during a form login, the method, mimetype and request body are specified, this handler will ensure that this request is included as an internal redirect.

< Module declines to handle

< Module has handled this stage.

Definition at line 1240 of file mod_auth_form.c.

◆ check_authn()

static int check_authn	(	request_rec *	r,
		const char *	sent_user,
		const char *	sent_pw
	)

static

Given a username and password (extracted externally from a cookie), run the authnz hooks to determine whether this request is authorized.

Return an HTTP code.

< Module declines to handle

< Module has handled this stage.

Definition at line 758 of file mod_auth_form.c.

◆ check_site()

static int check_site	(	request_rec *	r,
		const char *	site,
		const char *	sent_user,
		const char *	sent_hash
	)

static

Given a username and site passphrase hash from the session, determine whether the site passphrase is valid for this session.

If the site passphrase is NULL, or if the sent_hash is NULL, this function returns DECLINED.

If the site passphrase hash does not match the sent hash, this function returns AUTH_USER_NOT_FOUND.

On success, returns OK.

< Module has handled this stage.

< Module declines to handle

Definition at line 733 of file mod_auth_form.c.

◆ check_string()

static const char * check_string	(	cmd_parms *	cmd,
		const char *	string
	)

static

Sanity check a given string that it exists, is not empty, and does not contain special characters.

Definition at line 195 of file mod_auth_form.c.

◆ create_auth_form_dir_config()

static void * create_auth_form_dir_config	(	apr_pool_t *	p,
		char *	d
	)

static

Definition at line 83 of file mod_auth_form.c.

◆ fake_basic_authentication()

static void fake_basic_authentication	(	request_rec *	r,
		auth_form_config_rec *	conf,
		const char *	user,
		const char *	pw
	)

static

Definition at line 859 of file mod_auth_form.c.

◆ get_form_auth()

static int get_form_auth	(	request_rec *	r,
		const char *	username,
		const char *	password,
		const char *	location,
		const char *	method,
		const char *	mimetype,
		const char *	body,
		const char **	sent_user,
		const char **	sent_pw,
		const char **	sent_loc,
		const char **	sent_method,
		const char **	sent_mimetype,
		apr_bucket_brigade **	sent_body,
		auth_form_config_rec *	conf
	)

static

Isolate the username and password in a POSTed form with the username in the "username" field, and the password in the "password" field.

If either the username or the password is missing, this function will return HTTP_UNAUTHORIZED.

The location field is considered optional, and will be returned if present.

< Module has handled this stage.

Definition at line 589 of file mod_auth_form.c.

◆ get_notes_auth()

static void get_notes_auth	(	request_rec *	r,
		const char **	user,
		const char **	pw,
		const char **	method,
		const char **	mimetype
	)

static

Get the auth username and password from the main request notes table, if present.

Definition at line 471 of file mod_auth_form.c.

◆ get_session_auth()

static apr_status_t get_session_auth	(	request_rec *	r,
		const char **	user,
		const char **	pw,
		const char **	hash
	)

static

Get the auth username and password from the main request notes table, if present.

Definition at line 545 of file mod_auth_form.c.

◆ hook_note_cookie_auth_failure()

static int hook_note_cookie_auth_failure	(	request_rec *	r,
		const char *	auth_type
	)

static

< Module declines to handle

< Module has handled this stage.

Definition at line 419 of file mod_auth_form.c.

◆ merge_auth_form_dir_config()

static void * merge_auth_form_dir_config	(	apr_pool_t *	p,
		void *	basev,
		void *	addv
	)

static

Definition at line 105 of file mod_auth_form.c.

◆ note_cookie_auth_failure()

static void note_cookie_auth_failure ( request_rec * r )

static

Definition at line 409 of file mod_auth_form.c.

◆ register_hooks()

static void register_hooks ( apr_pool_t * p )

static

< Run access control hooks only on internal requests with configurations distinct from that of initial request

Definition at line 1305 of file mod_auth_form.c.

◆ set_authoritative()

static const char * set_authoritative	(	cmd_parms *	cmd,
		void *	config,
		int	flag
	)

static

Definition at line 328 of file mod_auth_form.c.

◆ set_cookie_form_body()

static const char * set_cookie_form_body	(	cmd_parms *	cmd,
		void *	config,
		const char *	body
	)

static

Definition at line 245 of file mod_auth_form.c.

◆ set_cookie_form_location()

static const char * set_cookie_form_location	(	cmd_parms *	cmd,
		void *	config,
		const char *	location
	)

static

Definition at line 205 of file mod_auth_form.c.

◆ set_cookie_form_method()

static const char * set_cookie_form_method	(	cmd_parms *	cmd,
		void *	config,
		const char *	method
	)

static

Definition at line 229 of file mod_auth_form.c.

◆ set_cookie_form_mimetype()

static const char * set_cookie_form_mimetype	(	cmd_parms *	cmd,
		void *	config,
		const char *	mimetype
	)

static

Definition at line 237 of file mod_auth_form.c.

◆ set_cookie_form_password()

static const char * set_cookie_form_password	(	cmd_parms *	cmd,
		void *	config,
		const char *	password
	)

static

Definition at line 221 of file mod_auth_form.c.

◆ set_cookie_form_size()

static const char * set_cookie_form_size	(	cmd_parms *	cmd,
		void *	config,
		const char *	arg
	)

static

Definition at line 253 of file mod_auth_form.c.

◆ set_cookie_form_username()

static const char * set_cookie_form_username	(	cmd_parms *	cmd,
		void *	config,
		const char *	username
	)

static

Definition at line 213 of file mod_auth_form.c.

◆ set_disable_no_store()

static const char * set_disable_no_store	(	cmd_parms *	cmd,
		void *	config,
		int	flag
	)

static

Definition at line 344 of file mod_auth_form.c.

◆ set_fake_basic_auth()

static const char * set_fake_basic_auth	(	cmd_parms *	cmd,
		void *	config,
		int	flag
	)

static

Definition at line 336 of file mod_auth_form.c.

◆ set_login_required_location()

static const char * set_login_required_location	(	cmd_parms *	cmd,
		void *	config,
		const char *	loginrequired
	)

static

Definition at line 269 of file mod_auth_form.c.

◆ set_login_success_location()

static const char * set_login_success_location	(	cmd_parms *	cmd,
		void *	config,
		const char *	loginsuccess
	)

static

Definition at line 286 of file mod_auth_form.c.

◆ set_logout_location()

static const char * set_logout_location	(	cmd_parms *	cmd,
		void *	config,
		const char *	logout
	)

static

Definition at line 303 of file mod_auth_form.c.

◆ set_notes_auth()

static void set_notes_auth	(	request_rec *	r,
		const char *	user,
		const char *	pw,
		const char *	method,
		const char *	mimetype
	)

static

Set the auth username and password into the main request notes table.

Definition at line 433 of file mod_auth_form.c.

◆ set_session_auth()

static apr_status_t set_session_auth	(	request_rec *	r,
		const char *	user,
		const char *	pw,
		const char *	site
	)

static

Set the auth username and password into the session.

If either the username, or the password are NULL, the username and/or password will be removed from the session.

Definition at line 520 of file mod_auth_form.c.

◆ set_site_passphrase()

static const char * set_site_passphrase	(	cmd_parms *	cmd,
		void *	config,
		const char *	site
	)

static

Definition at line 320 of file mod_auth_form.c.

Variable Documentation

◆ ap_request_insert_filter_fn

void(* ap_request_insert_filter_fn) (request_rec *r) ( request_rec * r ) = NULL

static

Definition at line 47 of file mod_auth_form.c.

◆ ap_request_remove_filter_fn

void(* ap_request_remove_filter_fn) (request_rec *r) ( request_rec * r ) = NULL

static

Definition at line 48 of file mod_auth_form.c.

◆ ap_session_get_fn

apr_OFN_ap_session_get_t* ap_session_get_fn = NULL

static

Definition at line 44 of file mod_auth_form.c.

◆ ap_session_load_fn

apr_OFN_ap_session_load_t* ap_session_load_fn = NULL

static

Definition at line 43 of file mod_auth_form.c.

◆ ap_session_set_fn

apr_OFN_ap_session_set_t* ap_session_set_fn = NULL

static

Definition at line 45 of file mod_auth_form.c.

◆ aplog_module_index

int* const aplog_module_index = &( auth_form_module.module_index)

static

Definition at line 1323 of file mod_auth_form.c.

◆ auth_form_cmds

const command_rec auth_form_cmds[]

static

Definition at line 352 of file mod_auth_form.c.

Classes

Macros

Functions

Variables

Macro Definition Documentation

◆ APR_WANT_STRFUNC

◆ FORM_LOGIN_HANDLER

◆ FORM_LOGOUT_HANDLER

◆ FORM_REDIRECT_HANDLER

◆ MOD_AUTH_FORM_HASH

Function Documentation

◆ add_authn_provider()

◆ authenticate_form_authn()

◆ authenticate_form_login_handler()

◆ authenticate_form_logout_handler()

◆ authenticate_form_post_config()

◆ authenticate_form_redirect_handler()

◆ check_authn()

◆ check_site()

◆ check_string()

◆ create_auth_form_dir_config()

◆ fake_basic_authentication()

◆ get_form_auth()

◆ get_notes_auth()

◆ get_session_auth()

◆ hook_note_cookie_auth_failure()

◆ merge_auth_form_dir_config()

◆ note_cookie_auth_failure()

◆ register_hooks()

◆ set_authoritative()

◆ set_cookie_form_body()

◆ set_cookie_form_location()

◆ set_cookie_form_method()

◆ set_cookie_form_mimetype()

◆ set_cookie_form_password()

◆ set_cookie_form_size()

◆ set_cookie_form_username()

◆ set_disable_no_store()

◆ set_fake_basic_auth()

◆ set_login_required_location()

◆ set_login_success_location()

◆ set_logout_location()

◆ set_notes_auth()

◆ set_session_auth()

◆ set_site_passphrase()

Variable Documentation

◆ ap_request_insert_filter_fn

◆ ap_request_remove_filter_fn

◆ ap_session_get_fn

◆ ap_session_load_fn

◆ ap_session_set_fn

◆ aplog_module_index

◆ auth_form_cmds