| /* Licensed to the Apache Software Foundation (ASF) under one or more |
| * contributor license agreements. See the NOTICE file distributed with |
| * this work for additional information regarding copyright ownership. |
| * The ASF licenses this file to You under the Apache License, Version 2.0 |
| * (the "License"); you may not use this file except in compliance with |
| * the License. You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| #include "mod_session.h" |
| #include "apr_lib.h" |
| #include "apr_strings.h" |
| #include "http_log.h" |
| #include "util_cookies.h" |
| #include "apr_dbd.h" |
| #include "mod_dbd.h" |
| #include "mpm_common.h" |
| |
| #define MOD_SESSION_DBD "mod_session_dbd" |
| |
| module AP_MODULE_DECLARE_DATA session_dbd_module; |
| |
| /** |
| * Structure to carry the per-dir session config. |
| */ |
| typedef struct { |
| const char *name; |
| int name_set; |
| const char *name_attrs; |
| const char *name2; |
| int name2_set; |
| const char *name2_attrs; |
| int peruser; |
| int peruser_set; |
| int remove; |
| int remove_set; |
| const char *selectlabel; |
| const char *insertlabel; |
| const char *updatelabel; |
| const char *deletelabel; |
| } session_dbd_dir_conf; |
| |
| /* optional function - look it up once in post_config */ |
| static ap_dbd_t *(*session_dbd_acquire_fn) (request_rec *) = NULL; |
| static void (*session_dbd_prepare_fn) (server_rec *, const char *, const char *) = NULL; |
| |
| /** |
| * Initialise the database. |
| * |
| * If the mod_dbd module is missing, this method will return APR_EGENERAL. |
| */ |
| static apr_status_t dbd_init(request_rec *r, const char *query, ap_dbd_t **dbdp, |
| apr_dbd_prepared_t **statementp) |
| { |
| ap_dbd_t *dbd; |
| apr_dbd_prepared_t *statement; |
| |
| if (!session_dbd_prepare_fn || !session_dbd_acquire_fn) { |
| session_dbd_prepare_fn = APR_RETRIEVE_OPTIONAL_FN(ap_dbd_prepare); |
| session_dbd_acquire_fn = APR_RETRIEVE_OPTIONAL_FN(ap_dbd_acquire); |
| if (!session_dbd_prepare_fn || !session_dbd_acquire_fn) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01850) |
| "You must load mod_dbd to enable AuthDBD functions"); |
| return APR_EGENERAL; |
| } |
| } |
| |
| dbd = session_dbd_acquire_fn(r); |
| if (!dbd) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01851) |
| "failed to acquire database connection"); |
| return APR_EGENERAL; |
| } |
| |
| statement = apr_hash_get(dbd->prepared, query, APR_HASH_KEY_STRING); |
| if (!statement) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01852) |
| "failed to find the prepared statement called '%s'", query); |
| return APR_EGENERAL; |
| } |
| |
| *dbdp = dbd; |
| *statementp = statement; |
| |
| return APR_SUCCESS; |
| } |
| |
| /** |
| * Load the session by the key specified. |
| * |
| * The session value is allocated using the passed apr_pool_t. |
| */ |
| static apr_status_t dbd_load(apr_pool_t *p, request_rec * r, |
| const char *key, const char **val) |
| { |
| |
| apr_status_t rv; |
| ap_dbd_t *dbd = NULL; |
| apr_dbd_prepared_t *statement = NULL; |
| apr_dbd_results_t *res = NULL; |
| apr_dbd_row_t *row = NULL; |
| apr_int64_t expiry = (apr_int64_t) apr_time_now(); |
| |
| session_dbd_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &session_dbd_module); |
| |
| if (conf->selectlabel == NULL) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01853) |
| "no SessionDBDselectlabel has been specified"); |
| return APR_EGENERAL; |
| } |
| |
| rv = dbd_init(r, conf->selectlabel, &dbd, &statement); |
| if (rv) { |
| return rv; |
| } |
| rv = apr_dbd_pvbselect(dbd->driver, r->pool, dbd->handle, &res, statement, |
| 0, key, &expiry, NULL); |
| if (rv) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01854) |
| "query execution error saving session '%s' " |
| "in database using query '%s': %s", key, conf->selectlabel, |
| apr_dbd_error(dbd->driver, dbd->handle, rv)); |
| return APR_EGENERAL; |
| } |
| for (rv = apr_dbd_get_row(dbd->driver, r->pool, res, &row, -1); |
| rv != -1; |
| rv = apr_dbd_get_row(dbd->driver, r->pool, res, &row, -1)) { |
| if (rv != 0) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01855) |
| "error retrieving results while saving '%s' " |
| "in database using query '%s': %s", key, conf->selectlabel, |
| apr_dbd_error(dbd->driver, dbd->handle, rv)); |
| return APR_EGENERAL; |
| } |
| if (*val == NULL) { |
| *val = apr_pstrdup(p, apr_dbd_get_entry(dbd->driver, row, 0)); |
| } |
| /* we can't break out here or row won't get cleaned up */ |
| } |
| |
| return APR_SUCCESS; |
| |
| } |
| |
| /** |
| * Load the session by firing off a dbd query. |
| * |
| * If the session is anonymous, the session key will be extracted from |
| * the cookie specified. Failing that, the session key will be extracted |
| * from the GET parameters. |
| * |
| * If the session is keyed by the username, the session will be extracted |
| * by that. |
| * |
| * If no session is found, an empty session will be created. |
| * |
| * On success, this returns OK. |
| */ |
| static apr_status_t session_dbd_load(request_rec * r, session_rec ** z) |
| { |
| |
| session_dbd_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &session_dbd_module); |
| |
| apr_status_t ret = APR_SUCCESS; |
| session_rec *zz = NULL; |
| const char *name = NULL; |
| const char *note = NULL; |
| const char *val = NULL; |
| const char *key = NULL; |
| request_rec *m = r->main ? r->main : r; |
| |
| /* is our session in a cookie? */ |
| if (conf->name2_set) { |
| name = conf->name2; |
| } |
| else if (conf->name_set) { |
| name = conf->name; |
| } |
| else if (conf->peruser_set && r->user) { |
| name = r->user; |
| } |
| else { |
| return DECLINED; |
| } |
| |
| /* first look in the notes */ |
| note = apr_pstrcat(m->pool, MOD_SESSION_DBD, name, NULL); |
| zz = (session_rec *)apr_table_get(m->notes, note); |
| if (zz) { |
| *z = zz; |
| return OK; |
| } |
| |
| /* load anonymous sessions */ |
| if (conf->name_set || conf->name2_set) { |
| |
| /* load an RFC2109 or RFC2965 compliant cookie */ |
| ap_cookie_read(r, name, &key, conf->remove); |
| if (key) { |
| ret = dbd_load(m->pool, r, key, &val); |
| if (ret != APR_SUCCESS) { |
| return ret; |
| } |
| } |
| |
| } |
| |
| /* load named session */ |
| else if (conf->peruser) { |
| if (r->user) { |
| ret = dbd_load(m->pool, r, r->user, &val); |
| if (ret != APR_SUCCESS) { |
| return ret; |
| } |
| } |
| } |
| |
| /* otherwise not for us */ |
| else { |
| return DECLINED; |
| } |
| |
| /* create a new session and return it */ |
| zz = (session_rec *) apr_pcalloc(m->pool, sizeof(session_rec)); |
| zz->pool = m->pool; |
| zz->entries = apr_table_make(zz->pool, 10); |
| if (key && val) { |
| apr_uuid_t *uuid = apr_pcalloc(zz->pool, sizeof(apr_uuid_t)); |
| if (APR_SUCCESS == apr_uuid_parse(uuid, key)) { |
| zz->uuid = uuid; |
| } |
| } |
| zz->encoded = val; |
| *z = zz; |
| |
| /* put the session in the notes so we don't have to parse it again */ |
| apr_table_setn(m->notes, note, (char *)zz); |
| |
| /* don't cache pages with a session */ |
| apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private"); |
| |
| return OK; |
| |
| } |
| |
| /** |
| * Save the session by the key specified. |
| */ |
| static apr_status_t dbd_save(request_rec * r, const char *oldkey, |
| const char *newkey, const char *val, apr_int64_t expiry) |
| { |
| |
| apr_status_t rv; |
| ap_dbd_t *dbd = NULL; |
| apr_dbd_prepared_t *statement; |
| int rows = 0; |
| |
| session_dbd_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &session_dbd_module); |
| |
| if (conf->updatelabel == NULL) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01856) |
| "no SessionDBDupdatelabel has been specified"); |
| return APR_EGENERAL; |
| } |
| |
| rv = dbd_init(r, conf->updatelabel, &dbd, &statement); |
| if (rv) { |
| return rv; |
| } |
| |
| if (oldkey) { |
| rv = apr_dbd_pvbquery(dbd->driver, r->pool, dbd->handle, &rows, |
| statement, val, &expiry, newkey, oldkey, NULL); |
| if (rv) { |
| ap_log_rerror( |
| APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01857) "query execution error updating session '%s' " |
| "using database query '%s': %s/%s", oldkey, newkey, conf->updatelabel, apr_dbd_error(dbd->driver, dbd->handle, rv)); |
| return APR_EGENERAL; |
| } |
| |
| /* |
| * if some rows were updated it means a session existed and was updated, |
| * so we are done. |
| */ |
| if (rows != 0) { |
| return APR_SUCCESS; |
| } |
| } |
| |
| if (conf->insertlabel == NULL) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01858) |
| "no SessionDBDinsertlabel has been specified"); |
| return APR_EGENERAL; |
| } |
| |
| rv = dbd_init(r, conf->insertlabel, &dbd, &statement); |
| if (rv) { |
| return rv; |
| } |
| rv = apr_dbd_pvbquery(dbd->driver, r->pool, dbd->handle, &rows, statement, |
| val, &expiry, newkey, NULL); |
| if (rv) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01859) |
| "query execution error inserting session '%s' " |
| "in database with '%s': %s", newkey, conf->insertlabel, |
| apr_dbd_error(dbd->driver, dbd->handle, rv)); |
| return APR_EGENERAL; |
| } |
| |
| /* |
| * if some rows were inserted it means a session was inserted, so we are |
| * done. |
| */ |
| if (rows != 0) { |
| return APR_SUCCESS; |
| } |
| |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01860) |
| "the session insert query did not cause any rows to be added " |
| "to the database for session '%s', session not inserted", newkey); |
| |
| return APR_EGENERAL; |
| |
| } |
| |
| /** |
| * Remove the session by the key specified. |
| */ |
| static apr_status_t dbd_remove(request_rec * r, const char *key) |
| { |
| |
| apr_status_t rv; |
| ap_dbd_t *dbd; |
| apr_dbd_prepared_t *statement; |
| int rows = 0; |
| |
| session_dbd_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &session_dbd_module); |
| |
| if (conf->deletelabel == NULL) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01862) |
| "no SessionDBDdeletelabel has been specified"); |
| return APR_EGENERAL; |
| } |
| |
| rv = dbd_init(r, conf->deletelabel, &dbd, &statement); |
| if (rv != APR_SUCCESS) { |
| /* No need to do additional error logging here, it has already |
| been done in dbd_init if needed */ |
| return rv; |
| } |
| |
| rv = apr_dbd_pvbquery(dbd->driver, r->pool, dbd->handle, &rows, statement, |
| key, NULL); |
| if (rv != APR_SUCCESS) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r, APLOGNO(01864) |
| "query execution error removing session '%s' " |
| "from database", key); |
| return rv; |
| } |
| |
| return APR_SUCCESS; |
| |
| } |
| |
| /** |
| * Clean out expired sessions. |
| * |
| * TODO: We need to figure out a way to clean out expired sessions from the database. |
| * The monitor hook doesn't help us that much, as we have no handle into the |
| * server, and so we need to come up with a way to do this safely. |
| */ |
| static apr_status_t dbd_clean(apr_pool_t *p, server_rec *s) |
| { |
| |
| return APR_ENOTIMPL; |
| |
| } |
| |
| /** |
| * Save the session by firing off a dbd query. |
| * |
| * If the session is anonymous, save the session and write a cookie |
| * containing the uuid. |
| * |
| * If the session is keyed to the username, save the session using |
| * the username as a key. |
| * |
| * On success, this method will return APR_SUCCESS. |
| * |
| * @param r The request pointer. |
| * @param z A pointer to where the session will be written. |
| */ |
| static apr_status_t session_dbd_save(request_rec * r, session_rec * z) |
| { |
| |
| apr_status_t ret = APR_SUCCESS; |
| session_dbd_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &session_dbd_module); |
| |
| /* support anonymous sessions */ |
| if (conf->name_set || conf->name2_set) { |
| char *oldkey = NULL, *newkey = NULL; |
| |
| /* if the session is new or changed, make a new session ID */ |
| if (z->uuid) { |
| oldkey = apr_pcalloc(r->pool, APR_UUID_FORMATTED_LENGTH + 1); |
| apr_uuid_format(oldkey, z->uuid); |
| } |
| if (z->dirty || !oldkey) { |
| z->uuid = apr_pcalloc(z->pool, sizeof(apr_uuid_t)); |
| apr_uuid_get(z->uuid); |
| newkey = apr_pcalloc(r->pool, APR_UUID_FORMATTED_LENGTH + 1); |
| apr_uuid_format(newkey, z->uuid); |
| } |
| else { |
| newkey = oldkey; |
| } |
| |
| /* save the session with the uuid as key */ |
| if (z->encoded && z->encoded[0]) { |
| ret = dbd_save(r, oldkey, newkey, z->encoded, z->expiry); |
| } |
| else { |
| ret = dbd_remove(r, oldkey); |
| } |
| if (ret != APR_SUCCESS) { |
| return ret; |
| } |
| |
| /* create RFC2109 compliant cookie */ |
| if (conf->name_set) { |
| ap_cookie_write(r, conf->name, newkey, conf->name_attrs, z->maxage, |
| r->headers_out, r->err_headers_out, NULL); |
| } |
| |
| /* create RFC2965 compliant cookie */ |
| if (conf->name2_set) { |
| ap_cookie_write2(r, conf->name2, newkey, conf->name2_attrs, z->maxage, |
| r->headers_out, r->err_headers_out, NULL); |
| } |
| |
| return OK; |
| |
| } |
| |
| /* save named session */ |
| else if (conf->peruser) { |
| |
| /* don't cache pages with a session */ |
| apr_table_addn(r->headers_out, "Cache-Control", "no-cache, private"); |
| |
| if (r->user) { |
| ret = dbd_save(r, r->user, r->user, z->encoded, z->expiry); |
| if (ret != APR_SUCCESS) { |
| return ret; |
| } |
| return OK; |
| } |
| else { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01865) |
| "peruser sessions can only be saved if a user is logged in, " |
| "session not saved: %s", r->uri); |
| } |
| } |
| |
| return DECLINED; |
| |
| } |
| |
| /** |
| * This function performs housekeeping on the database, deleting expired |
| * sessions. |
| */ |
| static int session_dbd_monitor(apr_pool_t *p, server_rec *s) |
| { |
| /* TODO handle housekeeping */ |
| dbd_clean(p, s); |
| return OK; |
| } |
| |
| |
| static void *create_session_dbd_dir_config(apr_pool_t * p, char *dummy) |
| { |
| session_dbd_dir_conf *new = |
| (session_dbd_dir_conf *) apr_pcalloc(p, sizeof(session_dbd_dir_conf)); |
| |
| new->remove = 1; |
| |
| new->selectlabel = "selectsession"; |
| new->insertlabel = "insertsession"; |
| new->updatelabel = "updatesession"; |
| new->deletelabel = "deletesession"; |
| |
| return (void *) new; |
| } |
| |
| static void *merge_session_dbd_dir_config(apr_pool_t * p, void *basev, void *addv) |
| { |
| session_dbd_dir_conf *new = (session_dbd_dir_conf *) apr_pcalloc(p, sizeof(session_dbd_dir_conf)); |
| session_dbd_dir_conf *add = (session_dbd_dir_conf *) addv; |
| session_dbd_dir_conf *base = (session_dbd_dir_conf *) basev; |
| |
| new->name = (add->name_set == 0) ? base->name : add->name; |
| new->name_attrs = (add->name_set == 0) ? base->name_attrs : add->name_attrs; |
| new->name_set = add->name_set || base->name_set; |
| new->name2 = (add->name2_set == 0) ? base->name2 : add->name2; |
| new->name2_attrs = (add->name2_set == 0) ? base->name2_attrs : add->name2_attrs; |
| new->name2_set = add->name2_set || base->name2_set; |
| new->peruser = (add->peruser_set == 0) ? base->peruser : add->peruser; |
| new->peruser_set = add->peruser_set || base->peruser_set; |
| new->remove = (add->remove_set == 0) ? base->remove : add->remove; |
| new->remove_set = add->remove_set || base->remove_set; |
| new->selectlabel = (!add->selectlabel) ? base->selectlabel : add->selectlabel; |
| new->updatelabel = (!add->updatelabel) ? base->updatelabel : add->updatelabel; |
| new->insertlabel = (!add->insertlabel) ? base->insertlabel : add->insertlabel; |
| new->deletelabel = (!add->deletelabel) ? base->deletelabel : add->deletelabel; |
| |
| return new; |
| } |
| |
| /** |
| * Sanity check a given string that it exists, is not empty, |
| * and does not contain special characters. |
| */ |
| static const char *check_string(cmd_parms * cmd, const char *string) |
| { |
| if (APR_SUCCESS != ap_cookie_check_string(string)) { |
| return apr_pstrcat(cmd->pool, cmd->directive->directive, |
| " cannot be empty, or contain '=', ';' or '&'.", |
| NULL); |
| } |
| return NULL; |
| } |
| |
| static const char * |
| set_dbd_peruser(cmd_parms * parms, void *dconf, int flag) |
| { |
| session_dbd_dir_conf *conf = dconf; |
| |
| conf->peruser = flag; |
| conf->peruser_set = 1; |
| |
| return NULL; |
| } |
| |
| static const char * |
| set_dbd_cookie_remove(cmd_parms * parms, void *dconf, int flag) |
| { |
| session_dbd_dir_conf *conf = dconf; |
| |
| conf->remove = flag; |
| conf->remove_set = 1; |
| |
| return NULL; |
| } |
| |
| static const char *set_cookie_name(cmd_parms * cmd, void *config, const char *args) |
| { |
| char *last; |
| char *line = apr_pstrdup(cmd->pool, args); |
| session_dbd_dir_conf *conf = (session_dbd_dir_conf *) config; |
| char *cookie = apr_strtok(line, " \t", &last); |
| conf->name = cookie; |
| conf->name_set = 1; |
| while (apr_isspace(*last)) { |
| last++; |
| } |
| conf->name_attrs = last; |
| return check_string(cmd, cookie); |
| } |
| |
| static const char *set_cookie_name2(cmd_parms * cmd, void *config, const char *args) |
| { |
| char *last; |
| char *line = apr_pstrdup(cmd->pool, args); |
| session_dbd_dir_conf *conf = (session_dbd_dir_conf *) config; |
| char *cookie = apr_strtok(line, " \t", &last); |
| conf->name2 = cookie; |
| conf->name2_set = 1; |
| while (apr_isspace(*last)) { |
| last++; |
| } |
| conf->name2_attrs = last; |
| return check_string(cmd, cookie); |
| } |
| |
| static const command_rec session_dbd_cmds[] = |
| { |
| AP_INIT_TAKE1("SessionDBDSelectLabel", ap_set_string_slot, |
| (void *) APR_OFFSETOF(session_dbd_dir_conf, selectlabel), RSRC_CONF|OR_AUTHCFG, |
| "Query label used to select a new session"), |
| AP_INIT_TAKE1("SessionDBDInsertLabel", ap_set_string_slot, |
| (void *) APR_OFFSETOF(session_dbd_dir_conf, insertlabel), RSRC_CONF|OR_AUTHCFG, |
| "Query label used to insert a new session"), |
| AP_INIT_TAKE1("SessionDBDUpdateLabel", ap_set_string_slot, |
| (void *) APR_OFFSETOF(session_dbd_dir_conf, updatelabel), RSRC_CONF|OR_AUTHCFG, |
| "Query label used to update an existing session"), |
| AP_INIT_TAKE1("SessionDBDDeleteLabel", ap_set_string_slot, |
| (void *) APR_OFFSETOF(session_dbd_dir_conf, deletelabel), RSRC_CONF|OR_AUTHCFG, |
| "Query label used to delete an existing session"), |
| AP_INIT_FLAG("SessionDBDPerUser", set_dbd_peruser, NULL, RSRC_CONF|OR_AUTHCFG, |
| "Save the session per user"), |
| AP_INIT_FLAG("SessionDBDCookieRemove", set_dbd_cookie_remove, NULL, RSRC_CONF|OR_AUTHCFG, |
| "Remove the session cookie after session load. On by default."), |
| AP_INIT_RAW_ARGS("SessionDBDCookieName", set_cookie_name, NULL, RSRC_CONF|OR_AUTHCFG, |
| "The name of the RFC2109 cookie carrying the session key"), |
| AP_INIT_RAW_ARGS("SessionDBDCookieName2", set_cookie_name2, NULL, RSRC_CONF|OR_AUTHCFG, |
| "The name of the RFC2965 cookie carrying the session key"), |
| {NULL} |
| }; |
| |
| static void register_hooks(apr_pool_t * p) |
| { |
| ap_hook_session_load(session_dbd_load, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_session_save(session_dbd_save, NULL, NULL, APR_HOOK_MIDDLE); |
| ap_hook_monitor(session_dbd_monitor, NULL, NULL, APR_HOOK_MIDDLE); |
| } |
| |
| AP_DECLARE_MODULE(session_dbd) = |
| { |
| STANDARD20_MODULE_STUFF, |
| create_session_dbd_dir_config, /* dir config creater */ |
| merge_session_dbd_dir_config, /* dir merger --- default is to |
| * override */ |
| NULL, /* server config */ |
| NULL, /* merge server config */ |
| session_dbd_cmds, /* command apr_table_t */ |
| register_hooks /* register hooks */ |
| }; |
