51 static handler_t mod_authn_gssapi_check(request_st *r, void *p_d, const struct http_auth_require_t …
52 static handler_t mod_authn_gssapi_basic(request_st *r, void *p_d, const http_auth_require_t *requir…
92 static void mod_authn_gssapi_patch_config(request_st * const r, plugin_data * const p) {  in mod_authn_gssapi_patch_config()  argument
96         if (config_check_cond(r, (uint32_t)p->cvlist[i].k_id))  in mod_authn_gssapi_patch_config()
154 static handler_t mod_authn_gssapi_send_400_bad_request (request_st * const r)  in mod_authn_gssapi_send_400_bad_request()  argument
156     r->http_status = 400;  in mod_authn_gssapi_send_400_bad_request()
157     r->handler_module = NULL;  in mod_authn_gssapi_send_400_bad_request()
206 static int mod_authn_gssapi_create_krb5_ccache(request_st * const r, plugin_data * const p, krb5_co…  in mod_authn_gssapi_create_krb5_ccache()  argument
213         log_perror(r->conf.errh, __FILE__, __LINE__, "mkstemp(): %s", ccname);  in mod_authn_gssapi_create_krb5_ccache()
223 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_resolve", NULL, kcontex…  in mod_authn_gssapi_create_krb5_ccache()
229 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_initialize", kccname, k…  in mod_authn_gssapi_create_krb5_ccache()
233         buffer * const vb = http_header_env_set_ptr(r, CONST_STR_LEN("KRB5CCNAME"));  in mod_authn_gssapi_create_krb5_ccache()
234         r->plugin_ctx[p->id] = vb;  in mod_authn_gssapi_create_krb5_ccache()
237 …http_header_request_set(r, HTTP_HEADER_OTHER, CONST_STR_LEN("X-Forwarded-Keytab"), ccname, ccnamel…  in mod_authn_gssapi_create_krb5_ccache()
257 static handler_t mod_authn_gssapi_send_500_server_error (request_st * const r)  in mod_authn_gssapi_send_500_server_error()  argument
259     r->http_status = 500;  in mod_authn_gssapi_send_500_server_error()
260     r->handler_module = NULL;  in mod_authn_gssapi_send_500_server_error()
264 static handler_t mod_authn_gssapi_send_401_unauthorized_negotiate (request_st * const r)  in mod_authn_gssapi_send_401_unauthorized_negotiate()  argument
266     r->http_status = 401;  in mod_authn_gssapi_send_401_unauthorized_negotiate()
267     r->handler_module = NULL;  in mod_authn_gssapi_send_401_unauthorized_negotiate()
268     http_header_response_set(r, HTTP_HEADER_WWW_AUTHENTICATE,  in mod_authn_gssapi_send_401_unauthorized_negotiate()
274 static int mod_authn_gssapi_store_gss_creds(request_st * const r, plugin_data * const p, char * con…  in mod_authn_gssapi_store_gss_creds()  argument
284 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_init_context", NULL, conte…  in mod_authn_gssapi_store_gss_creds()
290 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_parse_name", NULL, context…  in mod_authn_gssapi_store_gss_creds()
294     if (mod_authn_gssapi_create_krb5_ccache(r, p, context, princ, &ccache))  in mod_authn_gssapi_store_gss_creds()
299 …mod_authn_gssapi_log_gss_error(r->conf.errh, __FILE__, __LINE__, "gss_krb5_copy_ccache", princ_nam…  in mod_authn_gssapi_store_gss_creds()
318 static handler_t mod_authn_gssapi_check_spnego(request_st * const r, plugin_data * const p, const h…  in mod_authn_gssapi_check_spnego()  argument
335 …log_error(r->conf.errh, __FILE__, __LINE__, "decoding GSSAPI authentication header failed %s", rea…  in mod_authn_gssapi_check_spnego()
337         return mod_authn_gssapi_send_400_bad_request(r);  in mod_authn_gssapi_check_spnego()
340     mod_authn_gssapi_patch_config(r, p);  in mod_authn_gssapi_check_spnego()
363         if (r->http_host && !buffer_is_blank(r->http_host))  in mod_authn_gssapi_check_spnego()
365                                        r->http_host->ptr,  in mod_authn_gssapi_check_spnego()
366                                        strcspn(r->http_host->ptr, ":"));  in mod_authn_gssapi_check_spnego()
379 …mod_authn_gssapi_log_gss_error(r->conf.errh, __FILE__, __LINE__, "gss_import_name", NULL, st_major…  in mod_authn_gssapi_check_spnego()
386 …mod_authn_gssapi_log_gss_error(r->conf.errh, __FILE__, __LINE__, "gss_display_name", NULL, st_majo…  in mod_authn_gssapi_check_spnego()
393 …mod_authn_gssapi_log_gss_error(r->conf.errh, __FILE__, __LINE__, "gss_acquire_cred", sprinc->ptr, …  in mod_authn_gssapi_check_spnego()
403 …mod_authn_gssapi_log_gss_error(r->conf.errh, __FILE__, __LINE__, "gss_accept_sec_context", NULL, s…  in mod_authn_gssapi_check_spnego()
410 …mod_authn_gssapi_log_gss_error(r->conf.errh, __FILE__, __LINE__, "gss_display_name", NULL, st_majo…  in mod_authn_gssapi_check_spnego()
421 …log_error(r->conf.errh, __FILE__, __LINE__, "No confidentiality for user: %s", (char *)token_out.v…  in mod_authn_gssapi_check_spnego()
423 …log_error(r->conf.errh, __FILE__, __LINE__, "Unable to delegate credentials for user: %s", (char *…  in mod_authn_gssapi_check_spnego()
426         else if (!mod_authn_gssapi_store_gss_creds(r, p, token_out.value, client_cred)) {  in mod_authn_gssapi_check_spnego()
427             rc = mod_authn_gssapi_send_500_server_error(r);  in mod_authn_gssapi_check_spnego()
432     http_auth_setenv(r, token_out.value, token_out.length, CONST_STR_LEN("GSSAPI"));  in mod_authn_gssapi_check_spnego()
459         return rc != HANDLER_ERROR ? rc : mod_authn_gssapi_send_401_unauthorized_negotiate(r);  in mod_authn_gssapi_check_spnego()
462 static handler_t mod_authn_gssapi_check (request_st * const r, void *p_d, const struct http_auth_re…  in mod_authn_gssapi_check()  argument
464 …const buffer *vb = http_header_request_get(r, HTTP_HEADER_AUTHORIZATION, CONST_STR_LEN("Authorizat…  in mod_authn_gssapi_check()
468         return mod_authn_gssapi_send_401_unauthorized_negotiate(r);  in mod_authn_gssapi_check()
472         return mod_authn_gssapi_send_400_bad_request(r);  in mod_authn_gssapi_check()
475 …return mod_authn_gssapi_check_spnego(r, (plugin_data *)p_d, require, vb->ptr+sizeof("Negotiate ")-…  in mod_authn_gssapi_check()
579 static int mod_authn_gssapi_store_krb5_creds(request_st * const r, plugin_data * const p,  in mod_authn_gssapi_store_krb5_creds()  argument
588 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_get_principal", NULL, k…  in mod_authn_gssapi_store_krb5_creds()
592     if (mod_authn_gssapi_create_krb5_ccache(r, p, kcontext, princ, &ccache)) {  in mod_authn_gssapi_store_krb5_creds()
598 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_copy_creds", NULL, kcon…  in mod_authn_gssapi_store_krb5_creds()
614 static handler_t mod_authn_gssapi_send_401_unauthorized_basic (request_st * const r)  in mod_authn_gssapi_send_401_unauthorized_basic()  argument
616     r->http_status = 401;  in mod_authn_gssapi_send_401_unauthorized_basic()
617     r->handler_module = NULL;  in mod_authn_gssapi_send_401_unauthorized_basic()
618     http_header_response_set(r, HTTP_HEADER_WWW_AUTHENTICATE,  in mod_authn_gssapi_send_401_unauthorized_basic()
624 static handler_t mod_authn_gssapi_basic(request_st * const r, void *p_d, const http_auth_require_t …  in mod_authn_gssapi_basic()  argument
640         log_error(r->conf.errh, __FILE__, __LINE__, "Empty passwords are not accepted");  in mod_authn_gssapi_basic()
641         return mod_authn_gssapi_send_401_unauthorized_basic(r);  in mod_authn_gssapi_basic()
644     mod_authn_gssapi_patch_config(r, p);  in mod_authn_gssapi_basic()
648         log_error(r->conf.errh, __FILE__, __LINE__, "krb5_init_context(): %d", code);  in mod_authn_gssapi_basic()
649         return mod_authn_gssapi_send_401_unauthorized_basic(r); /*(well, should be 500)*/  in mod_authn_gssapi_basic()
653         log_error(r->conf.errh, __FILE__, __LINE__, "auth.backend.gssapi.keytab not configured");  in mod_authn_gssapi_basic()
654         return mod_authn_gssapi_send_401_unauthorized_basic(r); /*(well, should be 500)*/  in mod_authn_gssapi_basic()
659 …log_error(r->conf.errh, __FILE__, __LINE__, "krb5_kt_resolve(): %d %s", code, p->conf.auth_gssapi_…  in mod_authn_gssapi_basic()
660         return mod_authn_gssapi_send_401_unauthorized_basic(r); /*(well, should be 500)*/  in mod_authn_gssapi_basic()
671         if (r->http_host && !buffer_is_blank(r->http_host))  in mod_authn_gssapi_basic()
673                                        r->http_host->ptr,  in mod_authn_gssapi_basic()
674                                        strcspn(r->http_host->ptr, ":"));  in mod_authn_gssapi_basic()
682 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_parse_name", sprinc->ptr, …  in mod_authn_gssapi_basic()
695 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_parse_name", (user_at_real…  in mod_authn_gssapi_basic()
718 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_get_init_creds_password", …  in mod_authn_gssapi_basic()
722 …  ret = mod_authn_gssapi_verify_krb5_init_creds(kcontext, &c_creds, s_princ, keytab, r->conf.errh);  in mod_authn_gssapi_basic()
724 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "mod_authn_gssapi_verify_krb5_in…  in mod_authn_gssapi_basic()
732 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_resolve", NULL, kcontex…  in mod_authn_gssapi_basic()
738 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_initialize", NULL, kcon…  in mod_authn_gssapi_basic()
744 …mod_authn_gssapi_log_krb5_error(r->conf.errh, __FILE__, __LINE__, "krb5_cc_store_cred", NULL, kcon…  in mod_authn_gssapi_basic()
757 …     if (!ret && c_ccache && (ret = mod_authn_gssapi_store_krb5_creds(r, p, kcontext, c_ccache))) {  in mod_authn_gssapi_basic()
758 …log_error(r->conf.errh, __FILE__, __LINE__, "mod_authn_gssapi_store_krb5_creds failed for %s", use…  in mod_authn_gssapi_basic()
778             log_error(r->conf.errh, __FILE__, __LINE__,  in mod_authn_gssapi_basic()
780               r->uri.path.ptr, username->ptr, r->dst_addr_buf->ptr);  in mod_authn_gssapi_basic()
781             return mod_authn_gssapi_send_401_unauthorized_basic(r);  in mod_authn_gssapi_basic()
788     buffer * const ccname = (buffer *)r->plugin_ctx[p->id];  in REQUEST_FUNC()
790         r->plugin_ctx[p->id] = NULL;  in REQUEST_FUNC()