don't accept empty passwords

[mod_auth_kerb.git] / src / mod_auth_kerb.c

diff --git a/src/mod_auth_kerb.c b/src/mod_auth_kerb.c
index b633e3f..edd5ab0 100644 (file)
--- a/src/mod_auth_kerb.c
+++ b/src/mod_auth_kerb.c
@@ -123,6 +123,7 @@ module AP_MODULE_DECLARE_DATA auth_kerb_module;
 #define MK_TABLE_GET ap_table_get
 #define MK_USER r->connection->user
 #define MK_AUTH_TYPE r->connection->ap_auth_type
+#define PROXYREQ_PROXY STD_PROXY
 #else
 #define MK_POOL apr_pool_t
 #define MK_TABLE_GET apr_table_get
@@ -251,23 +252,17 @@ void log_rerror(const char *file, int line, int level, int status,
                 const request_rec *r, const char *fmt, ...)
 {
    char errstr[1024];
-   char errnostr[1024];
    va_list ap;
 
    va_start(ap, fmt);
    vsnprintf(errstr, sizeof(errstr), fmt, ap);
    va_end(ap);
 
-   errnostr[0] = '\0';
-   if (errno)
-      snprintf(errnostr, sizeof(errnostr), "%s: (%s)", errstr, strerror(errno));
-   else
-      snprintf(errnostr, sizeof(errnostr), "%s", errstr);
    
 #ifdef APXS1
-   ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errnostr);
+   ap_log_rerror(file, line, level | APLOG_NOERRNO, r, "%s", errstr);
 #else
-   ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errnostr);
+   ap_log_rerror(file, line, level | APLOG_NOERRNO, status, r, "%s", errstr);
 #endif
 }
 
@@ -656,6 +651,13 @@ int authenticate_user_krb5pwd(request_rec *r,
    }
 
    sent_pw = ap_pbase64decode(r->pool, auth_line);
+   if (sent_pw == NULL || *sent_pw == '\0') {
+      log_rerror(APLOG_MARK, APLOG_ERR, 0, r, 
+                "empty passwords are not accepted");
+      ret = HTTP_UNAUTHORIZED;
+      goto end;
+   }
+
    sent_name = ap_getword (r->pool, &sent_pw, ':');
    /* do not allow user to override realm setting of server */
    if (strchr(sent_name, '@')) {
@@ -785,21 +787,22 @@ get_gss_error(MK_POOL *p, OM_uint32 err_maj, OM_uint32 err_min, char *prefix)
                                     GSS_C_NO_OID,
                                     &msg_ctx,
                                     &status_string);
+      if (GSS_ERROR(maj_stat))
+        break;
       err_msg = ap_pstrcat(p, err_msg, ": ", (char*) status_string.value, NULL);
       gss_release_buffer(&min_stat, &status_string);
       
-      if (GSS_ERROR(maj_stat) || msg_ctx == 0)
-        break;
-
       maj_stat = gss_display_status (&min_stat,
                                     err_min,
                                     GSS_C_MECH_CODE,
                                     GSS_C_NULL_OID,
                                     &msg_ctx,
                                     &status_string);
-      err_msg = ap_pstrcat(p, err_msg,
-                          " (", (char*) status_string.value, ")", NULL);
-      gss_release_buffer(&min_stat, &status_string);
+      if (!GSS_ERROR(maj_stat)) {
+        err_msg = ap_pstrcat(p, err_msg,
+                             " (", (char*) status_string.value, ")", NULL);
+        gss_release_buffer(&min_stat, &status_string);
+      }
    } while (!GSS_ERROR(maj_stat) && msg_ctx != 0);
 
    return err_msg;
@@ -1117,6 +1120,8 @@ note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
    const char *auth_name = NULL;
    int set_basic = 0;
    char *negoauth_param;
+   const char *header_name = 
+      (r->proxyreq == PROXYREQ_PROXY) ? "Proxy-Authenticate" : "WWW-Authenticate";
 
    /* get the user realm specified in .htaccess */
    auth_name = ap_auth_name(r);
@@ -1126,19 +1131,19 @@ note_kerb_auth_failure(request_rec *r, const kerb_auth_config *conf,
    if (use_krb5 && conf->krb_method_gssapi && negotiate_ret_value != NULL) {
       negoauth_param = (*negotiate_ret_value == '\0') ? "Negotiate" :
                  ap_pstrcat(r->pool, "Negotiate ", negotiate_ret_value, NULL);
-      ap_table_add(r->err_headers_out, "WWW-Authenticate", negoauth_param);
+      ap_table_add(r->err_headers_out, header_name, negoauth_param);
    }
    if (use_krb5 && conf->krb_method_k5pass) {
-      ap_table_add(r->err_headers_out, "WWW-Authenticate",
-                   ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
+      ap_table_add(r->err_headers_out, header_name,
+                  ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
       set_basic = 1;
    }
 #endif
 
 #ifdef KRB4
    if (use_krb4 && conf->krb_method_k4pass && !set_basic)
-      ap_table_add(r->err_headers_out, "WWW-Authenticate",
-                  ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
+      ap_table_add(r->err_headers_out, header_name,
+                 ap_pstrcat(r->pool, "Basic realm=\"", auth_name, "\"", NULL));
 #endif
 }
 
@@ -1170,8 +1175,11 @@ int kerb_authenticate_user(request_rec *r)
    /* get what the user sent us in the HTTP header */
    auth_line = MK_TABLE_GET(r->headers_in, "Authorization");
    if (!auth_line) {
-      note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0");
-      return HTTP_UNAUTHORIZED;
+       auth_line = MK_TABLE_GET(r->headers_in, "Proxy-Authorization");
+       if (!auth_line) {
+               note_kerb_auth_failure(r, conf, use_krb4, use_krb5, "\0");
+               return HTTP_UNAUTHORIZED;
+       }
    }
    auth_type = ap_getword_white(r->pool, &auth_line);