text: /* Licensed to the Apache Software Foundation (ASF) under one or more
   * contributor license agreements.  See the NOTICE file distributed with
   * this work for additional information regarding copyright ownership.
   * The ASF licenses this file to You under the Apache License, Version 2.0
   * (the "License"); you may not use this file except in compliance with
   * the License.  You may obtain a copy of the License at
   *
   *     http://www.apache.org/licenses/LICENSE-2.0
   *
   * Unless required by applicable law or agreed to in writing, software
   * distributed under the License is distributed on an "AS IS" BASIS,
   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   * See the License for the specific language governing permissions and
   * limitations under the License.
   */
  
  /*
   * mod_ident: Handle RFC 1413 ident request
   * obtained from rfc1413.c
   *
   * rfc1413() speaks a common subset of the RFC 1413, AUTH, TAP and IDENT
   * protocols. The code queries an RFC 1413 etc. compatible daemon on a remote
   * host to look up the owner of a connection. The information should not be
   * used for authentication purposes. This routine intercepts alarm signals.
   *
   * Author: Wietse Venema, Eindhoven University of Technology,
   * The Netherlands.
   */
  
  /* Some small additions for Apache --- ditch the "sccsid" var if
   * compiling with gcc (it *has* changed), include ap_config.h for the
   * prototypes it defines on at least one system (SunlOSs) which has
   * them missing from the standard header files, and one minor change
   * below (extra parens around assign "if (foo = bar) ..." to shut up
   * gcc -Wall).
   */
  
  /* Rewritten by David Robinson */
  
  #include "apr.h"
  #include "apr_network_io.h"
  #include "apr_strings.h"
  #include "apr_optional.h"
  
  #define APR_WANT_STDIO
  #define APR_WANT_STRFUNC
  #include "apr_want.h"
  
  #include "httpd.h"              /* for server_rec, conn_rec, etc. */
  #include "http_config.h"
  #include "http_core.h"
  #include "http_log.h"           /* for aplog_error */
  #include "util_ebcdic.h"
  
  /* Whether we should enable rfc1413 identity checking */
  #ifndef DEFAULT_RFC1413
  #define DEFAULT_RFC1413    0
  #endif
  
  #define RFC1413_UNSET 2
  
  /* request timeout (sec) */
  #ifndef RFC1413_TIMEOUT
  #define RFC1413_TIMEOUT   30
  #endif
  
  /* Local stuff. */
  
  /* Semi-well-known port */
  #define RFC1413_PORT     113
  
  /* maximum allowed length of userid */
  #define RFC1413_USERLEN  512
  
  /* rough limit on the amount of data we accept. */
  #define RFC1413_MAXDATA 1000
  
  /* default username, if it could not determined */
  #define FROM_UNKNOWN  "unknown"
  
  typedef struct {
      int do_rfc1413;
      int timeout_unset;
      apr_time_t timeout;
  } ident_config_rec;
  
  static apr_status_t rfc1413_connect(apr_socket_t **newsock, conn_rec *conn,
                                      server_rec *srv, apr_time_t timeout)
  {
      apr_status_t rv;
      apr_sockaddr_t *localsa, *destsa;
  
      if ((rv = apr_sockaddr_info_get(&localsa, conn->local_ip, APR_UNSPEC,
                                0, /* ephemeral port */
                                0, conn->pool)) != APR_SUCCESS) {
          /* This should not fail since we have a numeric address string
           * as the host. */
          ap_log_error(APLOG_MARK, APLOG_CRIT, rv, srv, APLOGNO(01492)
                       "rfc1413: apr_sockaddr_info_get(%s) failed",
                       conn->local_ip);
          return rv;
      }
  
      if ((rv = apr_sockaddr_info_get(&destsa, conn->client_ip,
                                localsa->family, /* has to match */
                                RFC1413_PORT, 0, conn->pool)) != APR_SUCCESS) {
          /* This should not fail since we have a numeric address string
           * as the host. */
          ap_log_error(APLOG_MARK, APLOG_CRIT, rv, srv, APLOGNO(01493)
                       "rfc1413: apr_sockaddr_info_get(%s) failed",
                       conn->client_ip);
          return rv;
      }
  
      if ((rv = apr_socket_create(newsock,
                                  localsa->family, /* has to match */
                                  SOCK_STREAM, 0, conn->pool)) != APR_SUCCESS) {
          ap_log_error(APLOG_MARK, APLOG_CRIT, rv, srv, APLOGNO(01494)
                       "rfc1413: error creating query socket");
          return rv;
      }
  
      if ((rv = apr_socket_timeout_set(*newsock, timeout)) != APR_SUCCESS) {
          ap_log_error(APLOG_MARK, APLOG_CRIT, rv, srv, APLOGNO(01495)
                       "rfc1413: error setting query socket timeout");
          apr_socket_close(*newsock);
          return rv;
      }
  
  /*
   * Bind the local and remote ends of the query socket to the same
   * IP addresses as the connection under investigation. We go
   * through all this trouble because the local or remote system
   * might have more than one network address. The RFC1413 etc.
   * client sends only port numbers; the server takes the IP
   * addresses from the query socket.
   */
  
      if ((rv = apr_socket_bind(*newsock, localsa)) != APR_SUCCESS) {
          ap_log_error(APLOG_MARK, APLOG_CRIT, rv, srv, APLOGNO(01496)
                       "rfc1413: Error binding query socket to local port");
          apr_socket_close(*newsock);
          return rv;
      }
  
  /*
   * errors from connect usually imply the remote machine doesn't support
   * the service; don't log such an error
   */
      if ((rv = apr_socket_connect(*newsock, destsa)) != APR_SUCCESS) {
          apr_socket_close(*newsock);
          return rv;
      }
  
      return APR_SUCCESS;
  }
  
  static apr_status_t rfc1413_query(apr_socket_t *sock, conn_rec *conn,
                                    server_rec *srv)
  {
      apr_port_t rmt_port, our_port;
      apr_port_t sav_rmt_port, sav_our_port;
      apr_size_t i;
      char *cp;
      char buffer[RFC1413_MAXDATA + 1];
      char user[RFC1413_USERLEN + 1];     /* XXX */
      apr_size_t buflen;
  
      sav_our_port = conn->local_addr->port;
      sav_rmt_port = conn->client_addr->port;
  
      /* send the data */
      buflen = apr_snprintf(buffer, sizeof(buffer), "%hu,%hu\r\n", sav_rmt_port,
                            sav_our_port);
      ap_xlate_proto_to_ascii(buffer, buflen);
  
      /* send query to server. Handle short write. */
      i = 0;
      while (i < buflen) {
          apr_size_t j = strlen(buffer + i);
          apr_status_t status;
          status  = apr_socket_send(sock, buffer+i, &j);
          if (status != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_CRIT, status, srv, APLOGNO(01497)
                           "write: rfc1413: error sending request");
              return status;
          }
          else if (j > 0) {
              i+=j;
          }
      }
  
      /*
       * Read response from server. - the response should be newline
       * terminated according to rfc - make sure it doesn't stomp its
       * way out of the buffer.
       */
  
      i = 0;
      memset(buffer, '\0', sizeof(buffer));
      /*
       * Note that the strchr function below checks for \012 instead of '\n'
       * this allows it to work on both ASCII and EBCDIC machines.
       */
      while((cp = strchr(buffer, '\012')) == NULL && i < sizeof(buffer) - 1) {
          apr_size_t j = sizeof(buffer) - 1 - i;
          apr_status_t status;
          status = apr_socket_recv(sock, buffer+i, &j);
          if (status != APR_SUCCESS) {
              ap_log_error(APLOG_MARK, APLOG_CRIT, status, srv, APLOGNO(01498)
                           "read: rfc1413: error reading response");
              return status;
          }
          else if (j > 0) {
              i+=j;
          }
          else if (status == APR_SUCCESS && j == 0) {
              /* Oops... we ran out of data before finding newline */
              return APR_EINVAL;
          }
      }
  
  /* RFC1413_USERLEN = 512 */
      ap_xlate_proto_from_ascii(buffer, i);
      if (sscanf(buffer, "%hu , %hu : USERID :%*[^:]:%512s", &rmt_port, &our_port,
                 user) != 3 || sav_rmt_port != rmt_port
          || sav_our_port != our_port)
          return APR_EINVAL;
  
      /*
       * Strip trailing carriage return. It is part of the
       * protocol, not part of the data.
       */
  
      if ((cp = strchr(user, '\r')))
          *cp = '\0';
  
      conn->remote_logname = apr_pstrdup(conn->pool, user);
  
      return APR_SUCCESS;
  }
  
  static const char *set_idcheck(cmd_parms *cmd, void *d_, int arg)
  {
      ident_config_rec *d = d_;
  
      d->do_rfc1413 = arg ? 1 : 0;
      return NULL;
  }
  
  static const char *set_timeout(cmd_parms *cmd, void *d_, const char *arg)
  {
      ident_config_rec *d = d_;
  
      d->timeout = apr_time_from_sec(atoi(arg));
      d->timeout_unset = 0;
      return NULL;
  }
  
  static void *create_ident_dir_config(apr_pool_t *p, char *d)
  {
      ident_config_rec *conf = apr_palloc(p, sizeof(*conf));
  
      conf->do_rfc1413 = DEFAULT_RFC1413 | RFC1413_UNSET;
      conf->timeout = apr_time_from_sec(RFC1413_TIMEOUT);
      conf->timeout_unset = 1;
  
      return (void *)conf;
  }
  
  static void *merge_ident_dir_config(apr_pool_t *p, void *old_, void *new_)
  {
      ident_config_rec *conf = (ident_config_rec *)apr_pcalloc(p, sizeof(*conf));
      ident_config_rec *old = (ident_config_rec *) old_;
      ident_config_rec *new = (ident_config_rec *) new_;
  
      conf->timeout = new->timeout_unset
                          ? old->timeout
                          : new->timeout;
  
      conf->do_rfc1413 = new->do_rfc1413 & RFC1413_UNSET
                             ? old->do_rfc1413
                             : new->do_rfc1413;
  
      return (void *)conf;
  }
  
  static const command_rec ident_cmds[] =
  {
      AP_INIT_FLAG("IdentityCheck", set_idcheck, NULL, RSRC_CONF|ACCESS_CONF,
                   "Enable identd (RFC 1413) user lookups - SLOW"),
      AP_INIT_TAKE1("IdentityCheckTimeout", set_timeout, NULL,
                    RSRC_CONF|ACCESS_CONF,
                    "Identity check (RFC 1413) timeout duration (sec)"),
      {NULL}
  };
  
  module AP_MODULE_DECLARE_DATA ident_module;
  
  /*
   * Optional function for the core to to the actual ident request
   */
  static const char *ap_ident_lookup(request_rec *r)
  {
      ident_config_rec *conf;
      apr_socket_t *sock;
      apr_status_t rv;
      conn_rec *conn = r->connection;
      server_rec *srv = r->server;
  
      conf = ap_get_module_config(r->per_dir_config, &ident_module);
  
      /* return immediately if ident requests are disabled */
      if (!(conf->do_rfc1413 & ~RFC1413_UNSET)) {
          return NULL;
      }
  
      rv = rfc1413_connect(&sock, conn, srv, conf->timeout);
      if (rv == APR_SUCCESS) {
          rv = rfc1413_query(sock, conn, srv);
          apr_socket_close(sock);
      }
      if (rv != APR_SUCCESS) {
          conn->remote_logname = FROM_UNKNOWN;
      }
  
      return (const char *)conn->remote_logname;
  }
  
  static void register_hooks(apr_pool_t *p)
  {
      APR_REGISTER_OPTIONAL_FN(ap_ident_lookup);
  }
  
  AP_DECLARE_MODULE(ident) =
  {
      STANDARD20_MODULE_STUFF,
      create_ident_dir_config,       /* dir config creater */
      merge_ident_dir_config,        /* dir merger --- default is to override */
      NULL,                          /* server config */
      NULL,                          /* merge server config */
      ident_cmds,                    /* command apr_table_t */
      register_hooks                 /* register hooks */
  };
  