mod_auth_cookie.c

/* ====================================================================
 * The Apache Software License, Version 1.1
 *
 * Copyright (c) 2000-2003 The Apache Software Foundation.  All rights
 * reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * 1. Redistributions of source code must retain the above copyright
 *    notice, this list of conditions and the following disclaimer.
 *
 * 2. Redistributions in binary form must reproduce the above copyright
 *    notice, this list of conditions and the following disclaimer in
 *    the documentation and/or other materials provided with the
 *    distribution.
 *
 * 3. The end-user documentation included with the redistribution,
 *    if any, must include the following acknowledgment:
 *       "This product includes software developed by the
 *        Apache Software Foundation (http://www.apache.org/)."
 *    Alternately, this acknowledgment may appear in the software itself,
 *    if and wherever such third-party acknowledgments normally appear.
 *
 * 4. The names "Apache" and "Apache Software Foundation" must
 *    not be used to endorse or promote products derived from this
 *    software without prior written permission. For written
 *    permission, please contact apache@apache.org.
 *
 * 5. Products derived from this software may not be called "Apache",
 *    nor may "Apache" appear in their name, without prior written
 *    permission of the Apache Software Foundation.
 *
 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
 * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
 * DISCLAIMED.  IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
 * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
 * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
 * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
 * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 * SUCH DAMAGE.
 * ====================================================================
 *
 * This software consists of voluntary contributions made by many
 * individuals on behalf of the Apache Software Foundation.  For more
 * information on the Apache Software Foundation, please see
 * <http://www.apache.org/>.
 *
 * Portions of this software are based upon public domain software
 * originally written at the National Center for Supercomputing Applications,
 * University of Illinois, Urbana-Champaign.
 */

/*
 * mod_auth_cookie: authentication addon for Apache 2
 *
 * Version 0.2
 * September 2012
 * Enhancements by Greg Anderson (https://github.com/greg-1-anderson)
 *
 * Based on mod_auth_cookie for Apache 2.x by Richard Antony Burton,
 * January 2004 (Version 0.1), which was based on the original
 * concept for Apache 1.3 by Vivek Khera.
 *
 * Allows a cookie to be checked for authentication instead of the Authorization
 * header. This is an addon module to your normal auth module, that will fake
 * normal auth header with data from a cookie. Can be used to allow a form based
 * logon, rather than using the browsers user/password popup dialog. If cookie
 * is not present or contains invalid credentials, normal auth will resume, and
 * normal popup will occur, browser permitting.  If the popup dialog is not
 * desired, a configuration directive may be set to force a redirection to your
 * login page of choice.
 *
 * The configuration directives are compatible with the version for Apache 1.3,
 * although additional options have also been added.
 *
 * Place these directives to your <directory> stanza:
 *   (along with you normal auth config)
 *
 *   AuthCookieName             CookieName
 *   AuthCookieOverride         [ On | Off ] Default = Off
 *   AuthCookieBase64           [ On | Off ] Default = Off
 *   AuthCookieEnv              EnvironmentVariableName
 *   AuthCookieUnauthRedirect   url
 *   AuthCookieEnvRedirect      url
 *   AuthCookieEncrypt          shared_secret
 *
 *   AuthCookieName - the name of the cookie to consult for authorization information
 *
 *   AuthCookieOverride - if request contains both a cookie and an Authorization
 *       header, the cookie will be the one that is used.
 *
 *   AuthCookieBase64 - cookie contains "username:password" already base64 encoded
 *       as would be flowed in the normal Authorization header. This must be enabled
 *       to use the more advanced features such as AuthCookieEnv and AuthCookieEncrypt.
 *
 *   AuthCookieEnv - allows an environment variable to also be set during authenitcation.
 *       The AuthCookieEnv directive specifies the name of the environment variable to
 *       set; the environment variable value is stored after the username and password,
 *       separated by a <tab> character.  Thus, the full contents of the cookie will
 *       be "environment value<tab>username:password".
 *
 *       LIMITATION: AuthCookieEnv is only respected when in AuthCookieBase64 mode.
 *
 *   AuthCookieUnauthRedirect - if the cookie is not set, then redirect to this location.
 *
 *   AuthCookieEnvRedirect - if the cookie does not contain the optional auxiliary
 *       authentication information, then redirect to this location.
 *
 *   AuthCookieEnrypt - cookie is encrypted using the specified encryption key,
 *       which should by very long.  32 characters is good.  The format for the
 *       cookie then becomes "iv-vector mcrypt(data)", where 'data' contains the
 *       full unencrypted cookie value "environment value<tab>username:password".
 *       Sample code to create an encrypted cookie is available in the README
 *       file (php) and in crypt_sample.c.
 *
 *       LIMITATION:  AuthCookieEncrypt is only supported in AuthCookieBase64 mode.
 *       The cookie value should be encrypted and prepended with the IV before being
 *       base-64 encoded.
 *
 * Load using:
 *   LoadModule auth_cookie_module modules/mod_auth_cookie.so
 *
 */

#include "apr_strings.h"

#define APR_WANT_STRFUNC
#include "apr_want.h"
#include "apr_tables.h"

#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_request.h"
#include "http_protocol.h"

#include <mcrypt.h>

typedef struct {
    char *cookie_auth_cookie;
    char *cookie_auth_env;
    char *cookie_auth_env_redirect;
    char *cookie_auth_unauth_redirect;
    char *cookie_auth_encrypt;
    int cookie_auth_base64;
    int cookie_auth_override;
} cookie_auth_config_rec;

static void *create_cookie_auth_dir_config(apr_pool_t *p, char *d)
{
    cookie_auth_config_rec *conf = apr_palloc(p, sizeof(*conf));

	if (conf) {
        /* Set default values. */
        conf->cookie_auth_cookie = NULL;
	conf->cookie_auth_env = NULL;
	conf->cookie_auth_env_redirect = NULL;
	conf->cookie_auth_unauth_redirect = NULL;
	conf->cookie_auth_encrypt = NULL;
        conf->cookie_auth_base64 = 0;
        conf->cookie_auth_override = 0;
	}

    return conf;
}

/*
char* create_des_key(apr_pool_t *pool, char *ascii_key)
{
	char* result = apr_palloc(pool, 8);
	memset(result, '\0', 8);

	int i = 0;
	while(*ascii_key)
	{
		result[i] ^= (*ascii_key++) << 1;
		i = (i + 1) & 7;
	}

	des_setparity(result);

	return result;
}
*/

// If 'redirect' is foo/bar, then redirect to it.  If it is
// foo/bar/%s, then replace the %s with r->uri.
static void compose_and_set_redirect(request_rec *r, const char* redirect) {
	char* composed_redirect = NULL;
	if (ap_strstr_c(redirect, "%s")) {
		composed_redirect = apr_psprintf(r->pool, redirect, r->uri);
 	}
        apr_table_setn(r->headers_out, "Location", composed_redirect ? composed_redirect : redirect);
}

static const command_rec cookie_auth_cmds[] =
{
    AP_INIT_TAKE1("AuthCookieName", ap_set_string_slot,
	 (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_cookie),
	 OR_AUTHCFG, "auth cookie name"),
    AP_INIT_TAKE1("AuthCookieEnv", ap_set_string_slot,
	 (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_env),
	 OR_AUTHCFG, "environment variable name for optional auxiliary auth info"),
     AP_INIT_TAKE1("AuthCookieEnvRedirect", ap_set_string_slot,
	 (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_env_redirect),
	 OR_AUTHCFG, "path to redirect to if optional auxiliary auth info is missing in cookie"),
     AP_INIT_TAKE1("AuthCookieUnauthRedirect", ap_set_string_slot,
	 (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_unauth_redirect),
	 OR_AUTHCFG, "path to redirect to if authentication cookie is not set"),
   AP_INIT_TAKE1("AuthCookieEncrypt", ap_set_string_slot,
	 (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_encrypt),
	 OR_AUTHCFG, "secret key used to DES-encrypt the cookie"),
    AP_INIT_FLAG("AuthCookieOverride", ap_set_flag_slot,
     (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_override),
     OR_AUTHCFG, "Limited to 'on' or 'off'"),
    AP_INIT_FLAG("AuthCookieBase64", ap_set_flag_slot,
     (void *)APR_OFFSETOF(cookie_auth_config_rec, cookie_auth_base64),
     OR_AUTHCFG, "Limited to 'on' or 'off'"),
    {NULL}
};

module AP_MODULE_DECLARE_DATA auth_cookie_module;

static int check_auth_cookie(request_rec *r)
{

	const char *cookies = NULL, *auth_line = NULL;
	char *cookie = NULL;

    /* Debug. */
	/*ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
	    "check_auth_cookie called");*/

	/* Get config for this directory. */
    cookie_auth_config_rec *conf = ap_get_module_config(r->per_dir_config,
		&auth_cookie_module);

    /* Check we have been configured. */
    if (!conf->cookie_auth_cookie) {
        return DECLINED;
    }

	/* Do not override real auth header, unless config instructs us to. */
	if (!conf->cookie_auth_override &&
		apr_table_get(r->headers_in, "Authorization")) {
		if (conf->cookie_auth_env) {
			unsetenv(conf->cookie_auth_env);
		}
		return DECLINED;
	}

	/* todo: protect against xxxCookieNamexxx, regex? */
	/* todo: make case insensitive? */
	/* Get the cookie (code from mod_log_config). */
	if ((cookies = apr_table_get(r->headers_in, "Cookie"))) {
		char *start_cookie, *end_cookie;
		if ((start_cookie = ap_strstr_c(cookies, conf->cookie_auth_cookie))) {
		    start_cookie += strlen(conf->cookie_auth_cookie) + 1;
		    cookie = apr_pstrdup(r->pool, start_cookie);
			/* kill everything in cookie after ';' */
			end_cookie = strchr(cookie, ';');
			if (end_cookie) {
				*end_cookie = '\0';
      }
      ap_unescape_url(cookie);
		}
	}

	/* No cookie? Nothing for us to do. */
	if (!cookie) {
                if (conf->cookie_auth_unauth_redirect) {
        	        const char* redirect = conf->cookie_auth_unauth_redirect;
        		compose_and_set_redirect(r, redirect);
                        return HTTP_MOVED_TEMPORARILY;
                }
                else {
			return DECLINED;
                }
	}

	/* Debug. */
	/*ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
	    "%s=%s", conf->cookie_auth_cookie, cookie);*/

	char* aux_auth_info = "";

	/* Construct the fake auth_line. */
	if (conf->cookie_auth_base64) {
		char* decoded_cookie = apr_palloc(r->pool, apr_base64_decode_len(cookie));
    int decoded_cookie_length = apr_base64_decode(decoded_cookie, cookie);

		int valid = 1;

		/* if the cookie is encrypted, decrypt it in place */
		if (conf->cookie_auth_encrypt) {
      MCRYPT td = mcrypt_module_open("rijndael-128", NULL, "cbc", NULL);
      int keysize = strlen(conf->cookie_auth_encrypt);
      int blocksize = mcrypt_enc_get_block_size(td);

			// We will copy the iv from the beginning of the cookie.
			// The iv does not need to be null-terminated, but we will
			// null-terminate it for convenience.
			int iv_length = mcrypt_enc_get_iv_size(td);
			char* iv = (char*) apr_palloc(r->pool, iv_length + 1);
			memcpy(iv, decoded_cookie, iv_length);
			iv[iv_length] = '\0';

			// Take the iv off the beginning of the cookie
			decoded_cookie += iv_length;
      decoded_cookie_length -= iv_length;

      mcrypt_generic_init( td, conf->cookie_auth_encrypt, keysize, iv);
      // Encryption in CBC is performed in blocks, so our
      // decryption string will always be an integral number
      // of full blocks.
      char* decrypt_ptr = decoded_cookie;
      while (decoded_cookie_length >= blocksize) {
        mdecrypt_generic(td, decrypt_ptr, blocksize);
        decrypt_ptr += blocksize;
        decoded_cookie_length -= blocksize;
      }
      if (decoded_cookie_length != 0) {
        valid = 0;
      }
      mcrypt_generic_deinit (td);
      mcrypt_module_close(td);
      /*ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
        "mdecrypt(%s)=%s", conf->cookie_auth_cookie, decoded_cookie);*/
		}

		/* if the cookie did not decrypt, then do nothing */
		if (valid) {
			char* end_auth_info = strchr(decoded_cookie, '\t');

			if (end_auth_info) {
				aux_auth_info = decoded_cookie;
				char* unencoded_cookie = end_auth_info + 1;
				*end_auth_info = 0;

				auth_line = apr_pstrcat(r->pool, "Basic ", ap_pbase64encode(r->pool, unencoded_cookie), NULL);
			}
			else {
				auth_line = apr_pstrcat(r->pool, "Basic ", ap_pbase64encode(r->pool, decoded_cookie), NULL);
			}
		}
	} else {
		// Aux auth info and cookie encrypt features only available in base64 mode
		ap_unescape_url(cookie);
		auth_line = apr_pstrcat(r->pool, "Basic ",
			ap_pbase64encode(r->pool, cookie), NULL);
	}

	/* If there is aux auth info, then set the env variable */
	if (conf->cookie_auth_env) {
	  apr_table_set(r->subprocess_env, conf->cookie_auth_env, aux_auth_info);
	}

	/* Debug. */
	/*ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
		"Authorization: %s", auth_line);*/

	/* If there is no aux auth info, then force a redirect if our conf directives say that we should */
        if (conf->cookie_auth_env_redirect && !strlen(aux_auth_info)) {
        	const char* redirect = conf->cookie_auth_env_redirect;
        	compose_and_set_redirect(r, redirect);
                return HTTP_MOVED_TEMPORARILY;
        }
        else {
	        /* Set fake auth_line. */
		if (auth_line) {
                	apr_table_set(r->headers_in, "Authorization", auth_line);
                }
	}

	/* Always return DECLINED because we don't authorize, */
	/* we just set things up for the next auth module to. */
    return DECLINED;
}

static void register_hooks(apr_pool_t *p)
{
    /* Hook in before the other auth modules. */
    ap_hook_check_user_id(check_auth_cookie, NULL, NULL, APR_HOOK_FIRST);
}

module AP_MODULE_DECLARE_DATA auth_cookie_module =
{
    STANDARD20_MODULE_STUFF,
    create_cookie_auth_dir_config, /* per-directory config creator */
    NULL,                          /* dir config merger */
    NULL,                          /* server config creator */
    NULL,                          /* server config merger */
    cookie_auth_cmds,              /* command table */
    register_hooks                 /* set up other request processing hooks */
};