| /* Copyright 2002-2005 The Apache Software Foundation or its licensors, as |
| * applicable. |
| * |
| * Licensed under the Apache License, Version 2.0 (the "License"); |
| * you may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * http://www.apache.org/licenses/LICENSE-2.0 |
| * |
| * Unless required by applicable law or agreed to in writing, software |
| * distributed under the License is distributed on an "AS IS" BASIS, |
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| * See the License for the specific language governing permissions and |
| * limitations under the License. |
| */ |
| |
| /* |
| * Security options etc. |
| * |
| * Module derived from code originally written by Rob McCool |
| * |
| */ |
| |
| #include "apr_strings.h" |
| #include "apr_network_io.h" |
| #include "apr_md5.h" |
| |
| #define APR_WANT_STRFUNC |
| #define APR_WANT_BYTEFUNC |
| #include "apr_want.h" |
| |
| #define CORE_PRIVATE |
| #include "ap_config.h" |
| #include "httpd.h" |
| #include "http_config.h" |
| #include "http_core.h" |
| #include "http_log.h" |
| #include "http_request.h" |
| #include "http_protocol.h" |
| #include "ap_provider.h" |
| |
| #include "mod_auth.h" |
| |
| #if APR_HAVE_NETINET_IN_H |
| #include <netinet/in.h> |
| #endif |
| |
| /* TODO List |
| |
| X- Convert all of the authz modules to providers |
| X- Remove the ap_requires field from the core_dir_config structure |
| X- Remove the ap_requires field from authz_dir_conf |
| X- Remove the function ap_requires() and authz_ap_requires() |
| since their functionality is no longer supported |
| or necessary in the refactoring |
| X- Remove the calls to ap_some_auth_required() in the |
| core request handling to allow the hooks to be called |
| in all cases. Is this function even necessary |
| anymore? |
| - Determine of merge_authz_dir_config is even |
| necessary and remove if not |
| X- Split the authz type from the arguments when the |
| authz provider is registered and store the type |
| in ->provider_name and the arguments in ->requirement |
| X- Move the check for METHOD_MASK out of the authz |
| providers and into the provider vector |
| X- Change the status code to AUTHZ_DENIED, AUTHZ_GRANTED |
| and AUTHZ_GENERAL_ERROR |
| - Determine if setting the AUTHZ_PROVIDER_NAME_NOTE note |
| is even necessary. This was used in authn to support |
| authn_alias. Is there a need for an authz_alias? |
| X- Remove the Satisfy directive functionality and replace it with the |
| <SatisfyAll>, <SatisfyOne> directives |
| X- Remove the Satisfy directive |
| X- Implement the <SatisfyAll> <SatisfyOne> block directives |
| to handle the 'and' and 'or' logic for authorization. |
| X- Remove the AuthzXXXAuthoritative directives from all of |
| the authz providers |
| X- Implement the Reject directive that will deny authorization |
| if the argument is true |
| X- Fold the Reject directive into the <SatisfyAll> <SatisfyOne> |
| logic |
| X- Reimplement the host based authorization 'allow', 'deny' |
| and 'order' as authz providers |
| X- Remove the 'allow', 'deny' and 'order' directives |
| - Merge mod_authn_alias into mod_authn_core |
| X- Remove all of the references to the authzxxxAuthoritative |
| directives from the documentation |
| X- Remove the Satisfy directive from the documentation |
| */ |
| |
| typedef struct provider_alias_rec { |
| char *provider_name; |
| char *provider_alias; |
| char *provider_args; |
| ap_conf_vector_t *sec_auth; |
| const authz_provider *provider; |
| } provider_alias_rec; |
| |
| typedef struct { |
| authz_provider_list *providers; |
| authz_request_state req_state; |
| int req_state_level; |
| } authz_core_dir_conf; |
| |
| typedef struct authz_core_srv_conf { |
| apr_hash_t *alias_rec; |
| } authz_core_srv_conf; |
| |
| |
| module AP_MODULE_DECLARE_DATA authz_core_module; |
| |
| static void *create_authz_core_dir_config(apr_pool_t *p, char *dummy) |
| { |
| authz_core_dir_conf *conf = |
| (authz_core_dir_conf *)apr_pcalloc(p, sizeof(authz_core_dir_conf)); |
| |
| conf->req_state = AUTHZ_REQSTATE_ONE; |
| conf->req_state_level = 0; |
| return (void *)conf; |
| } |
| |
| #if 0 |
| static void *merge_authz_core_dir_config(apr_pool_t *a, void *basev, void *newv) |
| { |
| authz_core_dir_conf *base = (authz_core_dir_conf *)basev; |
| authz_core_dir_conf *new = (authz_core_dir_conf *)newv; |
| authz_core_dir_conf *conf; |
| |
| /* Create this conf by duplicating the base, replacing elements |
| * (or creating copies for merging) where new-> values exist. |
| */ |
| conf = (authz_core_dir_conf *)apr_palloc(a, sizeof(authz_core_dir_conf)); |
| memcpy(conf, base, sizeof(authz_core_dir_conf)); |
| |
| return (void*)conf; |
| } |
| #endif |
| |
| static void *create_authz_core_svr_config(apr_pool_t *p, server_rec *s) |
| { |
| |
| authz_core_srv_conf *authcfg; |
| |
| authcfg = (authz_core_srv_conf *) apr_pcalloc(p, sizeof(authz_core_srv_conf)); |
| authcfg->alias_rec = apr_hash_make(p); |
| |
| return (void *) authcfg; |
| } |
| |
| static const char *add_authz_provider(cmd_parms *cmd, void *config, |
| const char *arg) |
| { |
| authz_core_dir_conf *conf = (authz_core_dir_conf*)config; |
| authz_provider_list *newp; |
| const char *t, *w; |
| |
| newp = apr_pcalloc(cmd->pool, sizeof(authz_provider_list)); |
| |
| t = arg; |
| w = ap_getword_white(cmd->pool, &t); |
| |
| if (w) |
| newp->provider_name = apr_pstrdup(cmd->pool, w); |
| if (t) |
| newp->requirement = apr_pstrdup(cmd->pool, t); |
| newp->method_mask = cmd->limited; |
| |
| /* lookup and cache the actual provider now */ |
| newp->provider = ap_lookup_provider(AUTHZ_PROVIDER_GROUP, |
| newp->provider_name, "0"); |
| newp->req_state = conf->req_state; |
| newp->req_state_level = conf->req_state_level; |
| newp->is_reject = (int)cmd->info; |
| |
| /* by the time the config file is used, the provider should be loaded |
| * and registered with us. |
| */ |
| if (newp->provider == NULL) { |
| return apr_psprintf(cmd->pool, |
| "Unknown Authz provider: %s", |
| newp->provider_name); |
| } |
| |
| /* if the provider doesn't provide the appropriate function, reject it */ |
| if (!newp->provider->check_authorization) { |
| return apr_psprintf(cmd->pool, |
| "The '%s' Authz provider is not supported by any " |
| "of the loaded authorization modules ", |
| newp->provider_name); |
| } |
| |
| /* Add it to the list now. */ |
| if (!conf->providers) { |
| conf->providers = newp; |
| } |
| else { |
| authz_provider_list *last = conf->providers; |
| int level = conf->req_state_level; |
| |
| /* if the level is 0 then take care of the implicit 'or' |
| operation at this level. */ |
| if (level == 0) { |
| /* Just run through the Require_one list and add the |
| node */ |
| while (last->one_next) { |
| last = last->one_next; |
| } |
| last->one_next = newp; |
| } |
| else { |
| /* Traverse the list to find the last entry.Each level |
| indicates a transition in the logic. */ |
| for (;level;level--) { |
| /* if we are in a Require_all block then run through |
| all of the Require_all nodes to the end of the list */ |
| if (last->req_state == AUTHZ_REQSTATE_ALL) { |
| while (last->all_next) { |
| last = last->all_next; |
| } |
| /* If the end of the list contains a node state |
| change then run through all of the Require_one |
| nodes to the end of that list */ |
| if (level >= last->req_state_level) { |
| while (last->one_next) { |
| last = last->one_next; |
| } |
| } |
| continue; |
| } |
| /* if we are in a Require_one block then run through |
| all of the Require_one nodes to the end of the list */ |
| if (last->req_state == AUTHZ_REQSTATE_ONE) { |
| while (last->one_next) { |
| last = last->one_next; |
| } |
| /* If the end of the list contains a node state |
| change then run through all of the Require_all |
| nodes to the end of that list */ |
| if (level >= last->req_state_level) { |
| while (last->all_next) { |
| last = last->all_next; |
| } |
| } |
| continue; |
| } |
| } |
| |
| /* The current state flag indicates which way the transition should |
| go. If ALL then take the all_next path, otherwise one_next */ |
| if (last->req_state == AUTHZ_REQSTATE_ALL) { |
| /* If we already have an all_next node, then |
| we must have dropped back a level so assign |
| the node to one_next */ |
| if (!last->all_next) { |
| last->all_next = newp; |
| } |
| else |
| last->one_next = newp; |
| } |
| else { |
| /* If we already have a one_next node, then |
| we must have dropped back a level so assign |
| the node to all_next */ |
| if (!last->one_next) { |
| last->one_next = newp; |
| } |
| else |
| last->all_next = newp; |
| } |
| } |
| } |
| |
| return NULL; |
| } |
| |
| /* This is a fake authz provider that really merges various authz alias |
| configurations and then envokes them. */ |
| static authz_status authz_alias_check_authorization(request_rec *r, |
| const char *require_args) |
| { |
| /* Look up the provider alias in the alias list */ |
| /* Get the the dir_config and call ap_Merge_per_dir_configs() */ |
| /* Call the real provider->check_authorization() function */ |
| /* return the result of the above function call */ |
| |
| const char *provider_name = apr_table_get(r->notes, AUTHZ_PROVIDER_NAME_NOTE); |
| authz_status ret = AUTHZ_DENIED; |
| authz_core_srv_conf *authcfg = |
| (authz_core_srv_conf *)ap_get_module_config(r->server->module_config, |
| &authz_core_module); |
| |
| if (provider_name) { |
| provider_alias_rec *prvdraliasrec = apr_hash_get(authcfg->alias_rec, |
| provider_name, APR_HASH_KEY_STRING); |
| ap_conf_vector_t *orig_dir_config = r->per_dir_config; |
| |
| /* If we found the alias provider in the list, then merge the directory |
| configurations and call the real provider */ |
| if (prvdraliasrec) { |
| r->per_dir_config = ap_merge_per_dir_configs(r->pool, orig_dir_config, |
| prvdraliasrec->sec_auth); |
| ret = prvdraliasrec->provider->check_authorization(r, prvdraliasrec->provider_args); |
| r->per_dir_config = orig_dir_config; |
| } |
| } |
| |
| return ret; |
| } |
| |
| static const authz_provider authz_alias_provider = |
| { |
| &authz_alias_check_authorization, |
| }; |
| |
| static const char *authz_require_alias_section(cmd_parms *cmd, void *mconfig, const char *arg) |
| { |
| int old_overrides = cmd->override; |
| const char *endp = ap_strrchr_c(arg, '>'); |
| const char *args; |
| char *provider_alias; |
| char *provider_name; |
| char *provider_args; |
| const char *errmsg; |
| ap_conf_vector_t *new_authz_config = ap_create_per_dir_config(cmd->pool); |
| authz_core_srv_conf *authcfg = |
| (authz_core_srv_conf *)ap_get_module_config(cmd->server->module_config, |
| &authz_core_module); |
| |
| const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY); |
| if (err != NULL) { |
| return err; |
| } |
| |
| if (endp == NULL) { |
| return apr_pstrcat(cmd->pool, cmd->cmd->name, |
| "> directive missing closing '>'", NULL); |
| } |
| |
| args = apr_pstrndup(cmd->pool, arg, endp - arg); |
| |
| if (!args[0]) { |
| return apr_pstrcat(cmd->pool, cmd->cmd->name, |
| "> directive requires additional arguments", NULL); |
| } |
| |
| /* Pull the real provider name and the alias name from the block header */ |
| provider_name = ap_getword_conf(cmd->pool, &args); |
| provider_alias = ap_getword_conf(cmd->pool, &args); |
| provider_args = ap_getword_conf(cmd->pool, &args); |
| |
| if (!provider_name[0] || !provider_alias[0]) { |
| return apr_pstrcat(cmd->pool, cmd->cmd->name, |
| "> directive requires additional arguments", NULL); |
| } |
| |
| /* walk the subsection configuration to get the per_dir config that we will |
| merge just before the real provider is called. */ |
| cmd->override = OR_ALL|ACCESS_CONF; |
| errmsg = ap_walk_config(cmd->directive->first_child, cmd, new_authz_config); |
| |
| if (!errmsg) { |
| provider_alias_rec *prvdraliasrec = apr_pcalloc(cmd->pool, sizeof(provider_alias_rec)); |
| const authz_provider *provider = ap_lookup_provider(AUTHZ_PROVIDER_GROUP, provider_name,"0"); |
| |
| /* Save off the new directory config along with the original provider name |
| and function pointer data */ |
| prvdraliasrec->sec_auth = new_authz_config; |
| prvdraliasrec->provider_name = provider_name; |
| prvdraliasrec->provider_alias = provider_alias; |
| prvdraliasrec->provider_args = provider_args; |
| prvdraliasrec->provider = provider; |
| |
| apr_hash_set(authcfg->alias_rec, provider_alias, APR_HASH_KEY_STRING, prvdraliasrec); |
| |
| /* Register the fake provider so that we get called first */ |
| ap_register_provider(cmd->pool, AUTHZ_PROVIDER_GROUP, provider_alias, "0", |
| &authz_alias_provider); |
| } |
| |
| cmd->override = old_overrides; |
| |
| return errmsg; |
| } |
| |
| static const char *authz_require_section(cmd_parms *cmd, void *mconfig, const char *arg) |
| { |
| int old_overrides = cmd->override; |
| const char *endp = ap_strrchr_c(arg, '>'); |
| const char *args; |
| const char *errmsg; |
| authz_request_state old_reqstate; |
| authz_core_dir_conf *conf = (authz_core_dir_conf*)mconfig; |
| // authz_core_srv_conf *authcfg = |
| // (authz_core_srv_conf *)ap_get_module_config(cmd->server->module_config, |
| // &authz_core_module); |
| |
| if (endp == NULL) { |
| return apr_pstrcat(cmd->pool, cmd->cmd->name, |
| "> directive missing closing '>'", NULL); |
| } |
| |
| args = apr_pstrndup(cmd->pool, arg, endp - arg); |
| |
| if (args[0]) { |
| return apr_pstrcat(cmd->pool, cmd->cmd->name, |
| "> directive doesn't take additional arguments", NULL); |
| } |
| |
| /* Save off the current request state so that we can go back to it after walking |
| the subsection. Indicate a transition in the logic incrementing the level. |
| After the subsection walk the level will be decremented to indicate the |
| path to follow. As the require directives are read by the configuration |
| the req_state and the level will allow it to traverse the list to find |
| the last element in the provider calling list. */ |
| old_reqstate = conf->req_state; |
| if (strcasecmp (cmd->directive->directive, "<SatisfyAll") == 0) { |
| conf->req_state = AUTHZ_REQSTATE_ALL; |
| } |
| else { |
| conf->req_state = AUTHZ_REQSTATE_ONE; |
| } |
| conf->req_state_level++; |
| cmd->override = OR_ALL|ACCESS_CONF; |
| |
| /* walk the subsection configuration to get the per_dir config that we will |
| merge just before the real provider is called. */ |
| errmsg = ap_walk_config(cmd->directive->first_child, cmd, cmd->context); |
| |
| conf->req_state_level--; |
| conf->req_state = old_reqstate; |
| cmd->override = old_overrides; |
| |
| return errmsg; |
| } |
| |
| static const command_rec authz_cmds[] = |
| { |
| AP_INIT_RAW_ARGS("Require", add_authz_provider, NULL, OR_AUTHCFG, |
| "Selects which authenticated users or groups may access " |
| "a protected space"), |
| AP_INIT_RAW_ARGS("Reject", add_authz_provider, (void*)1, OR_AUTHCFG, |
| "Rejects the specified authenticated users or groups from accessing " |
| "a protected space"), |
| AP_INIT_RAW_ARGS("<RequireAlias", authz_require_alias_section, NULL, RSRC_CONF, |
| "Container for authorization directives grouped under " |
| "an authz provider alias"), |
| AP_INIT_RAW_ARGS("<SatisfyAll", authz_require_section, NULL, OR_AUTHCFG, |
| "Container for grouping require statements that must all " |
| "succeed for authorization to be granted"), |
| AP_INIT_RAW_ARGS("<SatisfyOne", authz_require_section, NULL, OR_AUTHCFG, |
| "Container for grouping require statements of which one " |
| "must succeed for authorization to be granted"), |
| {NULL} |
| }; |
| |
| static authz_status check_provider_list (request_rec *r, authz_provider_list *current_provider, int prev_level) |
| { |
| authz_status auth_result = AUTHZ_DENIED; |
| |
| const authz_provider *provider; |
| |
| /* For now, if a provider isn't set, we'll be nice and use the file |
| * provider. |
| */ |
| if (!current_provider) { |
| provider = ap_lookup_provider(AUTHZ_PROVIDER_GROUP, |
| AUTHZ_DEFAULT_PROVIDER, "0"); |
| |
| if (!provider || !provider->check_authorization) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| "No default authz provider configured"); |
| auth_result = AUTHZ_GENERAL_ERROR; |
| return auth_result; |
| } |
| apr_table_setn(r->notes, AUTHZ_PROVIDER_NAME_NOTE, |
| AUTHZ_DEFAULT_PROVIDER); |
| } |
| else { |
| provider = current_provider->provider; |
| apr_table_setn(r->notes, AUTHZ_PROVIDER_NAME_NOTE, |
| current_provider->provider_name); |
| } |
| |
| /* check to make sure that the request method requires |
| authorization before calling the provider */ |
| if (!(current_provider->method_mask & |
| (AP_METHOD_BIT << r->method_number))) { |
| return AUTHZ_DENIED; |
| } |
| |
| auth_result = provider->check_authorization(r, |
| current_provider->requirement); |
| |
| if (auth_result == AUTHZ_GENERAL_ERROR) { |
| return auth_result; |
| } |
| |
| if (current_provider->is_reject) { |
| auth_result = auth_result == AUTHZ_DENIED ? AUTHZ_GRANTED : AUTHZ_DENIED; |
| } |
| |
| apr_table_unset(r->notes, AUTHZ_PROVIDER_NAME_NOTE); |
| |
| /* If the current node is a Require_One type */ |
| if (current_provider->req_state == AUTHZ_REQSTATE_ONE) { |
| /* if the auth_result of *this* node was GRANTED and we are embedded in a Require_all block |
| then look to see if there is another Require_all node that needs to be satisfied */ |
| if (auth_result == AUTHZ_GRANTED) { |
| if ((current_provider->all_next) && |
| (current_provider->all_next->req_state_level < current_provider->req_state_level)) { |
| auth_result = check_provider_list (r, current_provider->all_next, |
| current_provider->req_state_level); |
| } |
| return auth_result; |
| } |
| one_next: |
| |
| /* Traverse forward to the next Require_one node it one exists |
| otherwise just return the auth_result */ |
| if (current_provider->one_next) { |
| auth_result = check_provider_list (r, current_provider->one_next, |
| current_provider->req_state_level); |
| } |
| else |
| return auth_result; |
| |
| /* if the *last* auth_result was GRANTED and we are embedded in a Require_all block |
| then look to see if there is another Require_all node that needs to be satisfied */ |
| if ((auth_result == AUTHZ_GRANTED) && (current_provider->all_next) && |
| (current_provider->all_next->req_state_level < current_provider->req_state_level)) { |
| auth_result = check_provider_list (r, current_provider->all_next, |
| current_provider->req_state_level); |
| } |
| /* If the *last* auth_result was DENIED and we are inside of a Require_one block |
| then look to see if there is another Require_one node that can be satisfied */ |
| else if ((auth_result == AUTHZ_DENIED) && (current_provider->one_next) && |
| (current_provider->one_next->req_state_level < current_provider->req_state_level)) { |
| goto one_next; |
| } |
| |
| return auth_result; |
| } |
| |
| /* If the current node is a Require_All type */ |
| if (current_provider->req_state == AUTHZ_REQSTATE_ALL) { |
| /* if the auth_result of *this* node was DENIED and we are embedded in a Require_one block |
| then look to see if there is another Require_one node that can be satisfied */ |
| if (auth_result == AUTHZ_DENIED) { |
| if ((current_provider->one_next) && |
| (current_provider->one_next->req_state_level < current_provider->req_state_level)) { |
| auth_result = check_provider_list (r, current_provider->one_next, |
| current_provider->req_state_level); |
| } |
| return auth_result; |
| } |
| all_next: |
| |
| /* Traverse forward to the next Require_all node it one exists |
| otherwise just return the auth_result */ |
| if (current_provider->all_next) { |
| auth_result = check_provider_list (r, current_provider->all_next, |
| current_provider->req_state_level); |
| } |
| else |
| return auth_result; |
| |
| /* if the *last* auth_result was DENIED and we are embedded in a Require_one block |
| then look to see if there is another Require_one node that can be satisfied */ |
| if ((auth_result == AUTHZ_DENIED) && (current_provider->one_next) && |
| (current_provider->one_next->req_state_level < current_provider->req_state_level)) { |
| auth_result = check_provider_list (r, current_provider->one_next, |
| current_provider->req_state_level); |
| } |
| /* If the *last* auth_result was GRANTED and we are inside of a Require_all block |
| then look to see if there is another Require_all node that needs to be satisfied */ |
| else if ((auth_result == AUTHZ_GRANTED) && (current_provider->all_next) && |
| (current_provider->all_next->req_state_level < current_provider->req_state_level)) { |
| goto all_next; |
| } |
| } |
| |
| return auth_result; |
| } |
| |
| static int authorize_user(request_rec *r) |
| { |
| authz_core_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &authz_core_module); |
| authz_status auth_result; |
| authz_provider_list *current_provider; |
| |
| /* If we're not really configured for providers, stop now. */ |
| if (!conf->providers) { |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| "no authorization providers configured"); |
| return DECLINED; |
| } |
| |
| current_provider = conf->providers; |
| |
| auth_result = check_provider_list (r, current_provider, 0); |
| |
| if (auth_result != AUTHZ_GRANTED) { |
| int return_code; |
| |
| switch (auth_result) { |
| case AUTHZ_DENIED: |
| ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, |
| "user %s: authorization failure for \"%s\": ", |
| r->user, r->uri); |
| return_code = HTTP_UNAUTHORIZED; |
| break; |
| case AUTHZ_GENERAL_ERROR: |
| default: |
| /* We'll assume that the module has already said what its |
| * error was in the logs. |
| */ |
| return_code = HTTP_INTERNAL_SERVER_ERROR; |
| break; |
| } |
| |
| /* If we're returning 403, tell them to try again. */ |
| if (return_code == HTTP_UNAUTHORIZED) { |
| ap_note_auth_failure (r); |
| } |
| return return_code; |
| } |
| |
| return OK; |
| } |
| |
| static int authz_some_auth_required(request_rec *r) |
| { |
| authz_core_dir_conf *conf = ap_get_module_config(r->per_dir_config, |
| &authz_core_module); |
| authz_provider_list *current_provider; |
| int req_authz = 0; |
| |
| current_provider = conf->providers; |
| while (current_provider) { |
| |
| /* Does this provider config apply for this method */ |
| if (current_provider->method_mask & |
| (AP_METHOD_BIT << r->method_number)) { |
| req_authz = 1; |
| break; |
| } |
| |
| current_provider = current_provider->one_next; |
| } |
| |
| return req_authz; |
| } |
| |
| static void register_hooks(apr_pool_t *p) |
| { |
| APR_REGISTER_OPTIONAL_FN(authz_some_auth_required); |
| |
| ap_hook_auth_checker(authorize_user, NULL, NULL, APR_HOOK_MIDDLE); |
| } |
| |
| module AP_MODULE_DECLARE_DATA authz_core_module = |
| { |
| STANDARD20_MODULE_STUFF, |
| create_authz_core_dir_config, /* dir config creater */ |
| NULL, /* dir merger --- default is to override */ |
| create_authz_core_svr_config, /* server config */ |
| NULL, /* merge server config */ |
| authz_cmds, |
| register_hooks /* register hooks */ |
| }; |
