/* Licensed to the Apache Software Foundation (ASF) under one or more

* contributor license agreements. See the NOTICE file distributed with

* this work for additional information regarding copyright ownership.

* The ASF licenses this file to You under the Apache License, Version 2.0

* (the "License"); you may not use this file except in compliance with

* the License. You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*

* Copyright 2011 Bradley K. Goodman

* brad at bradgoodman dot com

*

* Portions Copyright 2010 Google Inc.

* By Markus Gutschke

*

* This source code has been fixed for compiling error and other bugs by

* Nicola Asuni - Fubra.com - 2011-12-07

*/

#include "apr_strings.h"

#include "apr_md5.h" /* for apr_password_validate */

#include "ap_config.h"

#include "ap_provider.h"

#include "httpd.h"

#include "http_config.h"

#include "http_core.h"

#include "http_log.h"

#include "http_protocol.h"

#include "http_request.h"

#include "apr_sha1.h"

#include "mod_auth.h"

#include "base32.h"

#include "hmac.h"

#include "sha1.h"

#include "apu.h"

#include "apr_general.h"

#include "apr_base64.h"

#define DEBUG

ap_regex_t *cookie_regexp;

ap_regex_t *passwd_regexp;

typedef struct {

char *pwfile;

int cookieLife;

int entryWindow;

int debugLevel;

char *domain;

char *path;

} authn_google_config_rec;

static unsigned int get_timestamp() {

apr_time_t apr_time = apr_time_now();

apr_time /= 1000000;

apr_time /= 30;

// int unix_time = time(0L)/30;

// printf ("APR time is %lu unix time is %d\n",apr_time,unix_time);

return (apr_time);

}

static uint8_t *get_shared_secret( request_rec *r,

const char *buf, int *secretLen) {

// Decode secret key

int base32Len = strlen(buf);

*secretLen = (base32Len*5 + 7)/8;

unsigned char *secret = apr_palloc(r->pool,base32Len + 1);

memcpy(secret, buf, base32Len);

secret[base32Len] = '\000';

if ((*secretLen = base32_decode(secret, secret, base32Len)) < 1) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Could not find a valid BASE32 encoded secret");

memset(secret, 0, base32Len);

return NULL;

}

memset(secret + *secretLen, 0, base32Len + 1 - *secretLen);

return secret;

}

static void *create_authn_google_dir_config(apr_pool_t *p, char *d)

{

authn_google_config_rec *conf = apr_palloc(p, sizeof(*conf));

conf->pwfile = NULL; /* just to illustrate the default really */

conf->cookieLife = 0;

conf->entryWindow = 0;

conf->debugLevel = 0;

conf->domain = NULL;

conf->path = NULL;

return conf;

}

static const char *set_authn_google_slot(cmd_parms *cmd, void *offset,

const char *f, const char *t)

{

if (t && strcmp(t, "standard")) {

return apr_pstrcat(cmd->pool, "Invalid auth file type: ", t, NULL);

}

return ap_set_file_slot(cmd, offset, f);

}

static const char *set_authn_set_int(cmd_parms *cmd, void *offset,

const char *f )

{

return ap_set_int_slot(cmd, offset, f);

}

static const char *set_authn_set_string(cmd_parms *cmd, void *offset,

const char *f )

{

return ap_set_string_slot(cmd, offset, f);

}

static const command_rec authn_google_cmds[] =

{

AP_INIT_TAKE12("GoogleAuthUserPath", set_authn_google_slot,

(void *)APR_OFFSETOF(authn_google_config_rec, pwfile),

OR_AUTHCFG, "Directory containing Google Authenticator credential files"),

AP_INIT_TAKE1("GoogleAuthCookieLife", set_authn_set_int,

(void *)APR_OFFSETOF(authn_google_config_rec, cookieLife),

OR_AUTHCFG, "Life (in seconds) authentication cookie before revalidation required"),

AP_INIT_TAKE1("GoogleAuthLogLevel", set_authn_set_int,

(void *)APR_OFFSETOF(authn_google_config_rec, debugLevel),

OR_AUTHCFG, "Verbosity level of debug output (zero=off)"),

AP_INIT_TAKE1("GoogleAuthEntryWindow", set_authn_set_int,

(void *)APR_OFFSETOF(authn_google_config_rec, entryWindow),

OR_AUTHCFG, "Enable authentication cookies with lifespan given in seconds"),

AP_INIT_TAKE1("GoogleAuthDomain", set_authn_set_string,

(void *)APR_OFFSETOF(authn_google_config_rec, domain),

OR_AUTHCFG, "Custom domain to be set for the authentication cookie"),

AP_INIT_TAKE1("GoogleAuthPath", set_authn_set_string,

(void *)APR_OFFSETOF(authn_google_config_rec, path),

OR_AUTHCFG, "Fixed path to be set for the authentication cookie"),

{NULL}

};

module AP_MODULE_DECLARE_DATA authn_google_module;

static char * hash_cookie(apr_pool_t *p, uint8_t *secret,int secretLen,unsigned long expires) {

unsigned char hash[SHA1_DIGEST_LENGTH];

hmac_sha1(secret, secretLen, (uint8_t *) &expires, sizeof(unsigned int), hash, SHA1_DIGEST_LENGTH);

int len;

char *encoded = apr_palloc(p,(SHA1_DIGEST_LENGTH*2)+3);

len = apr_base64_encode_binary(encoded,hash,SHA1_DIGEST_LENGTH);

return encoded;

}

static char *getSharedKey(request_rec *r,char *filename, char **static_pw) {

ap_regmatch_t regmatch[AP_MAX_REG_MATCH];

char l[MAX_STRING_LEN];

char *sharedKey = 0L;

apr_status_t status;

ap_configfile_t *f;

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config, &authn_google_module);

status = ap_pcfg_openfile(&f, r->pool, filename);

ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,

"OPENING FILENAME %s",filename);

if (status != APR_SUCCESS) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,

"check_password: Couldn't open password file: %s", filename);

return 0L;

}

while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {

/* If we have a password entry - return it, if the caller has asked for it */

if ((static_pw) && (!ap_regexec(passwd_regexp, l, AP_MAX_REG_MATCH, regmatch, 0))) {

*static_pw = ap_pregsub(r->pool, "$1", l,AP_MAX_REG_MATCH,regmatch);

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Using static password \"%s\"",*static_pw);

}

/* Skip comment or blank lines. */

if ((l[0] == '"') || (!l[0])) {

continue;

}

if (!sharedKey) {

sharedKey = apr_pstrdup(r->pool,l);

}

/* Scratch codes to follow */

}

ap_cfg_closefile(f);

return sharedKey;

}

/**

* \brief getUserSecret Based on the given username, get the users secret key

* \param r Request

* \param username Username

* \param secret Secret key returned here. Must be allocated by caller

* \return Pointer to secret key data on success, NULL on error

**/

static uint8_t *getUserSecret(request_rec *r, const char *username, int *secretLen, char **static_pw) {

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config,

&authn_google_module);

char *ga_filename = apr_psprintf(r->pool,"%s/%s",conf->pwfile,username);

char *sharedKey;

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"getUserSecret with username \"%s\"\n",username);

sharedKey = getSharedKey(r,ga_filename,static_pw);

if (!sharedKey)

return 0L;

if (!sharedKey)

return 0L;

uint8_t *secret = get_shared_secret(r,sharedKey,secretLen);

return secret;

}

/**

* \brief find_cookie

* \param r

* \param user If not null, will return username here

* \param secret Secret key to hash

* \param secretLen

* \return Zero if not found or invalid, 1 if found valid cookie

* If secret key is NULL, function will extract username, and look

* up sercret key based on this username.

**/

static int find_cookie(request_rec *r,char **user,uint8_t *secret,int secretLen) {

char *cookie=0l;

char *cookie_expire=0l;

char *cookie_valid=0l;

ap_regmatch_t regmatch[AP_MAX_REG_MATCH];

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config, &authn_google_module);

cookie = (char *) apr_table_get(r->headers_in, "Cookie");

if (cookie) {

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Found cookie \"%s\"",cookie);

if (!ap_regexec(cookie_regexp, cookie, AP_MAX_REG_MATCH, regmatch, 0)) {

if (user) *user = ap_pregsub(r->pool, "$2", cookie,AP_MAX_REG_MATCH,regmatch);

cookie_expire = ap_pregsub(r->pool, "$3", cookie,AP_MAX_REG_MATCH,regmatch);

cookie_valid = ap_pregsub(r->pool, "$4", cookie,AP_MAX_REG_MATCH,regmatch);

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Found cookie Expires \"%s\" Valid \"%s\"",cookie_expire,cookie_valid);

if (cookie_expire && cookie_valid && *user) {

long unsigned int exp = apr_atoi64(cookie_expire);

long unsigned int now = apr_time_now()/1000000;

if (exp < now) {

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Expired. Now=%lu Expire=%lu\n",now,exp);

return 0; /* Expired */

}

if (!secret) {

secret = getUserSecret(r,*user,&secretLen,0L);

}

char *h = hash_cookie(r->pool,secret,secretLen,exp);

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Match cookie \"%s\" vs \"%s\"",h,cookie_valid);

if (apr_strnatcmp(h,cookie_valid)==0)

return 1; /* Valid Cookie */

else {

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"MISMATCHED cookie \"%s\" vs \"%s\"",h,cookie_valid);

return 0; /* Mismatched */

}

}

}

}

return 0; /* Not found */

}

void cookie_test(apr_pool_t *pool,char *cookie) {

char *user=0l;

char *cookie_expire=0l;

char *cookie_valid=0l;

ap_regmatch_t regmatch[AP_MAX_REG_MATCH];

//authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config, &authn_google_module);

if (!ap_regexec(cookie_regexp, cookie, AP_MAX_REG_MATCH, regmatch, 0)) {

user = ap_pregsub(pool, "$2", cookie,AP_MAX_REG_MATCH,regmatch);

cookie_expire = ap_pregsub(pool, "$3", cookie,AP_MAX_REG_MATCH,regmatch);

cookie_valid = ap_pregsub(pool, "$4", cookie,AP_MAX_REG_MATCH,regmatch);

printf("COOKIE GOOD: \"%s\" \"%s\" \"%s\"\n",user,cookie_expire,cookie_valid);

} else

printf ("INVALID COOKIE: \"%s\"\n",cookie);

}

void password_test(apr_pool_t *pool,char *cookie) {

char *user=0l;

ap_regmatch_t regmatch[AP_MAX_REG_MATCH];

printf("will regexec \n");

if (!ap_regexec(passwd_regexp, cookie, AP_MAX_REG_MATCH, regmatch, 0)) {

printf("regexec done\n");

user = ap_pregsub(pool, "$1", cookie,AP_MAX_REG_MATCH,regmatch);

printf("PASSWORD GOOD: \"%s\"\n",user);

} else

printf ("INVALID PASSWORD: \"%s\"\n",cookie);

}

static unsigned int computeTimeCode(unsigned int tm,unsigned char *secret, int secretLen) {

unsigned char hash[SHA1_DIGEST_LENGTH];

unsigned long chlg = tm ;

unsigned char challenge[8];

unsigned int truncatedHash = 0;

int j;

for (j = 8; j--; chlg >>= 8) {

challenge[j] = chlg;

}

hmac_sha1(secret, secretLen, challenge, 8, hash, SHA1_DIGEST_LENGTH);

int offset = hash[SHA1_DIGEST_LENGTH - 1] & 0xF;

for (j = 0; j < 4; ++j) {

truncatedHash <<= 8;

truncatedHash |= hash[offset + j];

}

memset(hash, 0, sizeof(hash));

truncatedHash &= 0x7FFFFFFF;

truncatedHash %= 1000000;

return truncatedHash;

}

/* Create and add an authentication cookie to the request,

if we have been configured to do so. This will allow

subsequent requests to work without having to re-authenticate */

static void addCookie(request_rec *r, uint8_t *secret, int secretLen) {

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config,

&authn_google_module);

if (conf->cookieLife) {

unsigned long exp = (apr_time_now() / (1000000) ) + conf->cookieLife;

char *h = hash_cookie(r->pool,secret,secretLen,exp);

char * cookie = apr_psprintf(r->pool,"google_authn=%s:%lu:%s",r->user,exp,h);

if (conf->domain) {

cookie = apr_pstrcat(r->pool,cookie,";domain=",conf->domain, NULL);

}

if (conf->path) {

cookie = apr_pstrcat(r->pool,cookie,";path=",conf->path, NULL);

}

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Created cookie expires %lu hash is %s Cookie: %s",exp,h,cookie);

apr_table_addn(r->headers_out,"Set-Cookie",cookie);

}

}

static authn_status ga_check_password(request_rec *r, const char *user,

const char *password)

{

/* Per Apache mod_auth.h:

* Given a username and password, expected to return AUTH_GRANTED

* if we can validate this user/password combination.

*/

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config,

&authn_google_module);

apr_status_t status=0;

int tm;

int i;

unsigned int truncatedHash = 0;

char *static_pw=0L;

char *correctpw=0L;

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"**** PW AUTH at T=%lu user \"%s\"",apr_time_now()/1000000,user);

int secretLen;

uint8_t *secret = getUserSecret(r,user,&secretLen,&static_pw);

if (!secret)

return AUTH_DENIED;

/***

*** Perform Google Authentication

***/

tm = get_timestamp();

//int code = (int) apr_atoi64(password);

for (i = -(conf->entryWindow); i <= (conf->entryWindow); ++i) {

truncatedHash = computeTimeCode(tm+i,secret,secretLen);

if (static_pw) {

correctpw = apr_pstrcat(r->pool,static_pw,

apr_psprintf(r->pool,"%6.6d",truncatedHash),NULL);

} else {

correctpw = apr_psprintf(r->pool,"%6.6d",truncatedHash);

}

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,

"Comparing Authentication @ T=%d Code=%d \"%s\" vs. \"%s\"",tm,truncatedHash,password,correctpw);

if (!apr_strnatcmp(correctpw,password)) {

/**\todo - check to see if time-based code has been invalidated */

addCookie(r,secret,secretLen);

return AUTH_GRANTED;

}

}

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, status, r,

"DENYING for \"%s\"",password);

return AUTH_DENIED;

}

static char *hex_encode(apr_pool_t *p, uint8_t *data,int len) {

const char *hex = "0123456789abcdef";

char *result = apr_palloc(p,(APR_MD5_DIGESTSIZE*2)+1);

int idx;

char *h = result;

for (idx=0; idx<APR_MD5_DIGESTSIZE; idx++) {

*h++ = hex[data[idx] >> 4];

*h++ = hex[data[idx] & 0xF];

}

*h=(char) 0;

return result;

}

/* This handles Digest Authentication. Returns a hash of the

User, Realm and (Required) Password. Caller (Digest module)

determines if the entered password was actually valid

*/

static authn_status ga_get_realm_hash(request_rec *r, const char *user,

const char *realm, char **rethash)

{

/* Per Apache mod_auth.h:

* Given a user and realm, expected to return AUTH_USER_FOUND if we

* can find a md5 hash of 'user:realm:password'

*/

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config,

&authn_google_module);

char *sharedKey;

char *ga_filename;

char *static_pw;

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"**** DIGEST AUTH at T=%lu user \"%s\"",apr_time_now()/1000000,user);

unsigned char *hash = apr_palloc(r->pool,APR_MD5_DIGESTSIZE);

ga_filename = apr_psprintf(r->pool,"%s/%s",conf->pwfile,user);

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"GetRealmHash called for sharedkey \"%s\"\n",ga_filename);

sharedKey = getSharedKey(r,ga_filename,&static_pw);

if (!sharedKey)

return AUTH_USER_NOT_FOUND;

int secretLen;

uint8_t *secret = get_shared_secret(r,sharedKey,&secretLen);

unsigned int truncatedHash = computeTimeCode(get_timestamp(),secret,secretLen);

char *pwstr;

if (static_pw) {

pwstr = apr_psprintf(r->pool,"%s%6.6u",static_pw,truncatedHash);

}

else

{

pwstr = apr_psprintf(r->pool,"%6.6u",truncatedHash);

}

char *hashstr = apr_psprintf(r->pool,"%s:%s:%s",user,realm,pwstr);

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Password \"%s\" at modulus %lu",pwstr,(apr_time_now() / 1000000) % 30);

apr_md5(hash ,hashstr,strlen(hashstr));

*rethash = hex_encode(r->pool,hash,APR_MD5_DIGESTSIZE);

addCookie(r,secret,secretLen);

return AUTH_USER_FOUND;

}

/***

*** Check for Valid

*** Authentication Cookie

***/

static int do_cookie_auth(request_rec *r) {

char *user;

authn_google_config_rec *conf = ap_get_module_config(r->per_dir_config,

&authn_google_module);

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"**** COOKIE AUTH at T=%lu",apr_time_now()/1000000);

if (conf->cookieLife && find_cookie(r,&user,0L,0L)) {

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"User %s auth granted from cookie",user);

r->user = user;

r->ap_auth_type = "Cookie";

return OK;

} else {

if (conf->debugLevel)

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Cookie auth is DECLINED");

}

return DECLINED; /* Let someone else deal with it */

}

static void ga_child_init (apr_pool_t *p, server_rec *s) {

// Parse cookie string (See RFC-2109 for format), looking for ours.

//

// Regexp:

// At the beginning of a line, OR after a cookie delimter (followed by optional whitespace)

// Look for a google_authn token, consisting of three colon-separated fields,

// Each field containing one or more characters which are not cookie-delimiters (comma or semicolon).

cookie_regexp= ap_pregcomp(p, "(^|[;,][ \t]*)google_authn[ \t]*=[ \t]*([^;,]+):([^;,]+):([^;,]+)", AP_REG_EXTENDED);

passwd_regexp= ap_pregcomp(p, "^\\s*\"\\s*PASSWORD\\s*=\\s*(\\S+)", AP_REG_EXTENDED);

#ifdef TEST_PASS

password_test(p," \" PASSWORD=abc ");

password_test(p," \" PASSWORD =abc ");

password_test(p," \" PASSWORD = abc ");

password_test(p," \" PASSWORD= abc ");

password_test(p," \"PASSWORD=abc ");

password_test(p," \"PASSWORD =abc ");

password_test(p," \"PASSWORD = abc ");

password_test(p," \"PASSWORD= abc ");

password_test(p,"\" PASSWORD=abc ");

password_test(p,"\" PASSWORD =abc ");

password_test(p,"\" PASSWORD = abc ");

password_test(p,"\" PASSWORD= abc ");

password_test(p,"\"PASSWORD=abc ");

password_test(p,"\"PASSWORD =abc ");

password_test(p,"\"PASSWORD = abc ");

password_test(p,"\"PASSWORD= abc ");

password_test(p," \" PASSWORD=abc");

password_test(p," \" PASSWORD =abc");

password_test(p," \" PASSWORD = abc");

password_test(p," \" PASSWORD= abc");

password_test(p," \"PASSWORD=abc");

password_test(p," \"PASSWORD =abc");

password_test(p," \"PASSWORD = abc");

password_test(p," \"PASSWORD= abc");

password_test(p,"\" PASSWORD=abc");

password_test(p,"\" PASSWORD =abc");

password_test(p,"\" PASSWORD = abc");

password_test(p,"\" PASSWORD= abc");

password_test(p,"\"PASSWORD=abc");

password_test(p,"\"PASSWORD =abc");

password_test(p,"\"PASSWORD = abc");

password_test(p,"\"PASSWORD= abc");

cookie_test(p,"google_authn=a:b:c");

cookie_test(p,"pma_lang=en; pma_collation_connection=utf8_general_ci; pma_navi_width=200; phpMyAdmin=dsofhasouphf8975q98u; google_authn=lucky:3692581470:9fZZrZ6kMaL2dwXzrfTsqIWdi/c=:; __utma=68896193.834633149.1320516436.1357578935.1357599597.89;__utmz=68896193.1352322698.7.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utmc=68896193; member_id=3; pass_hash=09812387643abcdef; ipsconnect_0989875asfdsapofjkjlnsdfau=1");

#endif

}

static const authn_provider authn_google_provider =

{

&ga_check_password,

&ga_get_realm_hash,

};

static void register_hooks(apr_pool_t *p)

{

static const char * const parsePre[]={ "mod_auth_digest.c", NULL };

ap_register_provider(p, AUTHN_PROVIDER_GROUP, "google_authenticator", "0",

&authn_google_provider);

ap_hook_child_init(ga_child_init,0L,0L,APR_HOOK_MIDDLE);

ap_hook_check_user_id(do_cookie_auth,0L,parsePre,APR_HOOK_FIRST);

}

module AP_MODULE_DECLARE_DATA authn_google_module =

{

STANDARD20_MODULE_STUFF,

create_authn_google_dir_config, /* dir config creater */

NULL, /* dir merger --- default is to override */

NULL, /* server config */

NULL, /* merge server config */

authn_google_cmds, /* command apr_table_t */

register_hooks /* register hooks */

};