/* Licensed to the Apache Software Foundation (ASF) under one or more

 * contributor license agreements.  See the NOTICE file distributed with

 * this work for additional information regarding copyright ownership.

 * The ASF licenses this file to You under the Apache License, Version 2.0

 * (the "License"); you may not use this file except in compliance with

 * the License.  You may obtain a copy of the License at

 *

 *     http://www.apache.org/licenses/LICENSE-2.0

 *

 * Unless required by applicable law or agreed to in writing, software

 * distributed under the License is distributed on an "AS IS" BASIS,

 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

 * See the License for the specific language governing permissions and

 * limitations under the License.

 */

#include "apr_hash.h"

#include "apr_lib.h"

#include "apr_strings.h"

#include "ap_provider.h"

#include "httpd.h"

#include "http_config.h"

#include "http_core.h"

#include "http_protocol.h"

#include "http_request.h"

#include "http_log.h"

#include "util_script.h"

#include "ap_provider.h"

#include "mod_auth.h"

#include "util_fcgi.h"

#include "ap_mmn.h"

module AP_MODULE_DECLARE_DATA authnz_fcgi_module;

typedef struct {

    const char *name; /* provider name */

    const char *backend; /* backend address, as configured */

    const char *host;

    apr_port_t port;

    apr_sockaddr_t *backend_addrs;

    int is_authn;

    int is_authz;

} fcgi_provider_conf;

typedef struct {

    const char *name; /* provider name */

    const char *default_user; /* this is user if authorizer returns

                               * success and a user expression yields

                               * empty string

                               */

    ap_expr_info_t *user_expr; /* expr to evaluate to set r->user */

    char authoritative; /* fail request if user is rejected? */

    char require_basic_auth; /* fail if client didn't send credentials? */

} fcgi_dir_conf;

typedef struct {

    /* If an "authnz" provider successfully authenticates, record

     * the provider name here for checking during authz.

     */

    const char *successful_authnz_provider;

} fcgi_request_notes;

static apr_hash_t *fcgi_authn_providers, *fcgi_authz_providers;

#define FCGI_IO_TIMEOUT apr_time_from_sec(30)

#ifndef NON200_RESPONSE_BUF_LEN

#define NON200_RESPONSE_BUF_LEN 8192

#endif

/* fcgi://{hostname|IPv4|IPv6}:port[/] */

#define FCGI_BACKEND_REGEX_STR "m%^fcgi://(.*):(\\d{1,5})/?$%"

/*

 * utility function to connect to a peer; generally useful, but 

 * wait for AF_UNIX support in this mod before thinking about how

 * to make it available to other modules

 */

static apr_status_t connect_to_peer(apr_socket_t **newsock,

                                    request_rec *r,

                                    apr_sockaddr_t *backend_addrs,

                                    const char *backend_name,

                                    apr_interval_time_t timeout)

{

    apr_status_t rv = APR_EINVAL; /* returned if no backend addr was provided

                                   */

    int connected = 0;

    apr_sockaddr_t *addr = backend_addrs;

    while (addr && !connected) {

        int loglevel = addr->next ? APLOG_DEBUG : APLOG_ERR;

        rv = apr_socket_create(newsock, addr->family,

                               SOCK_STREAM, 0, r->pool);

        if (rv != APR_SUCCESS) {

            ap_log_rerror(APLOG_MARK, loglevel, rv, r,

                          APLOGNO(02494) "error creating family %d socket "

                          "for target %s",

                          addr->family, backend_name);

            addr = addr->next;

            continue;

        }

        apr_socket_opt_set(*newsock, APR_TCP_NODELAY, 1);

        apr_socket_timeout_set(*newsock,

                               timeout ? timeout : r->server->timeout);

        rv = apr_socket_connect(*newsock, addr);

        if (rv != APR_SUCCESS) {

            apr_socket_close(*newsock);

            ap_log_rerror(APLOG_MARK, loglevel, rv, r,

                          APLOGNO(02495) "attempt to connect to %pI (%s) "

                          "failed", addr, backend_name);

            addr = addr->next;

            continue;

        }

        connected = 1;

    }

    return rv;

#undef FN_LOG_MARK

}

static void log_provider_info(const fcgi_provider_conf *conf, request_rec *r)

{

    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                  APLOGNO(02496) "name %s, backend %s, host %s, port %d, "

                  "first address %pI, %c%c",

                  conf->name,

                  conf->backend,

                  conf->host,

                  (int)conf->port,

                  conf->backend_addrs,

                  conf->is_authn ? 'N' : '_',

                  conf->is_authz ? 'Z' : '_');

}

static void setupenv(request_rec *r, const char *password, const char *apache_role)

{

    ap_add_common_vars(r);

    ap_add_cgi_vars(r);

    apr_table_setn(r->subprocess_env, "FCGI_ROLE", AP_FCGI_AUTHORIZER_STR);

    if (apache_role) {

        apr_table_setn(r->subprocess_env, "FCGI_APACHE_ROLE", apache_role);

    }

    if (password) {

        apr_table_setn(r->subprocess_env, "REMOTE_PASSWD", password);

    }

    /* Drop the variables CONTENT_LENGTH, PATH_INFO, PATH_TRANSLATED,

     * SCRIPT_NAME and most Hop-By-Hop headers - EXCEPT we will pass

     * PROXY_AUTH to allow CGI to perform proxy auth for httpd

     */

    apr_table_unset(r->subprocess_env, "CONTENT_LENGTH");

    apr_table_unset(r->subprocess_env, "PATH_INFO");

    apr_table_unset(r->subprocess_env, "PATH_TRANSLATED");

    apr_table_unset(r->subprocess_env, "SCRIPT_NAME");

    apr_table_unset(r->subprocess_env, "HTTP_KEEP_ALIVE");

    apr_table_unset(r->subprocess_env, "HTTP_TE");

    apr_table_unset(r->subprocess_env, "HTTP_TRAILER");

    apr_table_unset(r->subprocess_env, "HTTP_TRANSFER_ENCODING");

    apr_table_unset(r->subprocess_env, "HTTP_UPGRADE");

    /* Connection hop-by-hop header to prevent the CGI from hanging */

    apr_table_setn(r->subprocess_env, "HTTP_CONNECTION", "close");

}

static apr_status_t recv_data(const fcgi_provider_conf *conf,

                              request_rec *r,

                              apr_socket_t *s,

                              char *buf,

                              apr_size_t *buflen)

{

    apr_status_t rv;

    rv = apr_socket_recv(s, buf, buflen);

    if (rv != APR_SUCCESS) {

        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                      APLOGNO(02497) "Couldn't read from backend %s",

                      conf->backend);

        return rv;

    }

#if AP_MODULE_MAGIC_AT_LEAST(20130702,2) 

    ap_log_rdata(APLOG_MARK, APLOG_TRACE5, r, "FastCGI data received",

                 buf, *buflen, AP_LOG_DATA_SHOW_OFFSET);

#endif

    return APR_SUCCESS;

}

static apr_status_t recv_data_full(const fcgi_provider_conf *conf,

                                   request_rec *r,

                                   apr_socket_t *s,

                                   char *buf,

                                   apr_size_t buflen)

{

    apr_size_t readlen;

    apr_size_t cumulative_len = 0;

    apr_status_t rv;

    do {

        readlen = buflen - cumulative_len;

        rv = recv_data(conf, r, s, buf + cumulative_len, &readlen);

        if (rv != APR_SUCCESS) {

            return rv;

        }

        cumulative_len += readlen;

    } while (cumulative_len < buflen);

    return APR_SUCCESS;

}

static apr_status_t sendv_data(const fcgi_provider_conf *conf,

                               request_rec *r,

                               apr_socket_t *s,

                               struct iovec *vec,

                               int nvec,

                               apr_size_t *len)

{

    apr_size_t to_write = 0, written = 0;

    apr_status_t rv = APR_SUCCESS;

    int i, offset;

    for (i = 0; i < nvec; i++) {

        to_write += vec[i].iov_len;

#if AP_MODULE_MAGIC_AT_LEAST(20130702,2) 

        ap_log_rdata(APLOG_MARK, APLOG_TRACE5, r, "FastCGI data sent",

                     vec[i].iov_base, vec[i].iov_len, AP_LOG_DATA_SHOW_OFFSET);

#endif

    }

    offset = 0;

    while (to_write) {

        apr_size_t n = 0;

        rv = apr_socket_sendv(s, vec + offset, nvec - offset, &n);

        if (rv != APR_SUCCESS) {

            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

                          APLOGNO(02498) "Sending data to %s failed",

                          conf->backend);

            break;

        }

        if (n > 0) {

            written += n;

            if (written >= to_write)

                break;                 /* short circuit out */

            for (i = offset; i < nvec; ) {

                if (n >= vec[i].iov_len) {

                    offset++;

                    n -= vec[i++].iov_len;

                } else {

                    vec[i].iov_len -= n;

                    vec[i].iov_base = (char *) vec[i].iov_base + n;

                    break;

                }

            }

        }

    }

    *len = written;

    return rv;

}

static apr_status_t send_begin_request(request_rec *r,

                                       const fcgi_provider_conf *conf,

                                       apr_socket_t *s, int role,

                                       apr_uint16_t request_id)

{

    struct iovec vec[2];

    ap_fcgi_header header;

    unsigned char farray[AP_FCGI_HEADER_LEN];

    ap_fcgi_begin_request_body brb;

    unsigned char abrb[AP_FCGI_HEADER_LEN];

    apr_size_t len;

    ap_fcgi_fill_in_header(&header, AP_FCGI_BEGIN_REQUEST, request_id,

                           sizeof(abrb), 0);

    ap_fcgi_fill_in_request_body(&brb, role, 0 /* *NOT* AP_FCGI_KEEP_CONN */);

    ap_fcgi_header_to_array(&header, farray);

    ap_fcgi_begin_request_body_to_array(&brb, abrb);

    vec[0].iov_base = (void *)farray;

    vec[0].iov_len = sizeof(farray);

    vec[1].iov_base = (void *)abrb;

    vec[1].iov_len = sizeof(abrb);

    return sendv_data(conf, r, s, vec, 2, &len;;

}

static apr_status_t send_environment(apr_socket_t *s,

                                     const fcgi_provider_conf *conf,

                                     request_rec *r, apr_uint16_t request_id,

                                     apr_pool_t *temp_pool)

{

    const char *fn = "send_environment";

    const apr_array_header_t *envarr;

    const apr_table_entry_t *elts;

    struct iovec vec[2];

    ap_fcgi_header header;

    unsigned char farray[AP_FCGI_HEADER_LEN];

    char *body;

    apr_status_t rv;

    apr_size_t avail_len, len, required_len;

    int i, next_elem, starting_elem;

    envarr = apr_table_elts(r->subprocess_env);

    elts = (const apr_table_entry_t *) envarr->elts;

    if (APLOG_R_IS_LEVEL(r, APLOG_TRACE2)) {

        for (i = 0; i < envarr->nelts; ++i) {

            if (!elts[i].key) {

                continue;

            }

            ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

                          "%s: '%s': '%s'",

                          fn, elts[i].key, 

                          !strcmp(elts[i].key, "REMOTE_PASSWD") ?

                              "XXXXXXXX" : elts[i].val);

        }

    }

    /* Send envvars over in as many FastCGI records as it takes, */

    next_elem = 0; /* starting with the first one */

    avail_len = 16 * 1024; /* our limit per record, which could have been up

                            * to AP_FCGI_MAX_CONTENT_LEN

                            */

    while (next_elem < envarr->nelts) {

        starting_elem = next_elem;

        required_len = ap_fcgi_encoded_env_len(r->subprocess_env,

                                               avail_len,

                                               &next_elem);

        if (!required_len) {

            if (next_elem < envarr->nelts) {

                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

                              APLOGNO(02499) "couldn't encode envvar '%s' in %"

                              APR_SIZE_T_FMT " bytes",

                              elts[next_elem].key, avail_len);

                /* skip this envvar and continue */

                ++next_elem;

                continue;

            }

            /* only an unused element at the end of the array */

            break;

        }

        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                      APLOGNO(02500) "required len for encoding envvars: %"

                      APR_SIZE_T_FMT ", %d/%d elems processed so far",

                      required_len, next_elem, envarr->nelts);

        body = apr_palloc(temp_pool, required_len);

        rv = ap_fcgi_encode_env(r, r->subprocess_env, body, required_len,

                                &starting_elem);

        /* we pre-compute, so we can't run out of space */

        ap_assert(rv == APR_SUCCESS);

        /* compute and encode must be in sync */

        ap_assert(starting_elem == next_elem);

        ap_fcgi_fill_in_header(&header, AP_FCGI_PARAMS, request_id,

                               (apr_uint16_t)required_len, 0);

        ap_fcgi_header_to_array(&header, farray);

        vec[0].iov_base = (void *)farray;

        vec[0].iov_len = sizeof(farray);

        vec[1].iov_base = body;

        vec[1].iov_len = required_len;

        rv = sendv_data(conf, r, s, vec, 2, &len;;

        apr_pool_clear(temp_pool);

        if (rv) {

            return rv;

        }

    }

    /* Envvars sent, so say we're done */

    ap_fcgi_fill_in_header(&header, AP_FCGI_PARAMS, request_id, 0, 0);

    ap_fcgi_header_to_array(&header, farray);

    vec[0].iov_base = (void *)farray;

    vec[0].iov_len = sizeof(farray);

    return sendv_data(conf, r, s, vec, 1, &len;;

}

/*

 * This header-state logic is from mod_proxy_fcgi.

 */

enum {

  HDR_STATE_READING_HEADERS,

  HDR_STATE_GOT_CR,

  HDR_STATE_GOT_CRLF,

  HDR_STATE_GOT_CRLFCR,

  HDR_STATE_GOT_LF,

  HDR_STATE_DONE_WITH_HEADERS

};

/* Try to find the end of the script headers in the response from the back

 * end fastcgi server. STATE holds the current header parsing state for this

 * request.

 *

 * Returns 0 if it can't find the end of the headers, and 1 if it found the

 * end of the headers. */

static int handle_headers(request_rec *r, int *state,

                          const char *readbuf, apr_size_t readlen)

{

    const char *itr = readbuf;

    while (readlen--) {

        if (*itr == '\r') {

            switch (*state) {

                case HDR_STATE_GOT_CRLF:

                    *state = HDR_STATE_GOT_CRLFCR;

                    break;

                default:

                    *state = HDR_STATE_GOT_CR;

                    break;

            }

        }

        else if (*itr == '\n') {

            switch (*state) {

                 case HDR_STATE_GOT_LF:

                     *state = HDR_STATE_DONE_WITH_HEADERS;

                     break;

                 case HDR_STATE_GOT_CR:

                     *state = HDR_STATE_GOT_CRLF;

                     break;

                 case HDR_STATE_GOT_CRLFCR:

                     *state = HDR_STATE_DONE_WITH_HEADERS;

                     break;

                 default:

                     *state = HDR_STATE_GOT_LF;

                     break;

            }

        }

        else {

            *state = HDR_STATE_READING_HEADERS;

        }

        if (*state == HDR_STATE_DONE_WITH_HEADERS)

            break;

        ++itr;

    }

    if (*state == HDR_STATE_DONE_WITH_HEADERS) {

        return 1;

    }

    return 0;

}

/*

 * handle_response() is based on mod_proxy_fcgi's dispatch()

 */

static apr_status_t handle_response(const fcgi_provider_conf *conf,

                                    request_rec *r, apr_socket_t *s,

                                    apr_pool_t *temp_pool,

                                    apr_uint16_t request_id,

                                    char *rspbuf,

                                    apr_size_t *rspbuflen)

{

    apr_bucket *b;

    apr_bucket_brigade *ob;

    apr_size_t orspbuflen = 0;

    apr_status_t rv = APR_SUCCESS;

    const char *fn = "handle_response";

    int header_state = HDR_STATE_READING_HEADERS;

    int seen_end_of_headers = 0, done = 0;

    if (rspbuflen) {

        orspbuflen = *rspbuflen;

        *rspbuflen = 0; /* unless we actually read something */

    }

    ob = apr_brigade_create(r->pool, r->connection->bucket_alloc);

    while (!done && rv == APR_SUCCESS) { /* Keep reading FastCGI records until

                                          * we get AP_FCGI_END_REQUEST (done)

                                          * or an error occurs.

                                          */

        apr_size_t readbuflen;

        apr_uint16_t clen;

        apr_uint16_t rid;

        char readbuf[AP_IOBUFSIZE + 1];

        unsigned char farray[AP_FCGI_HEADER_LEN];

        unsigned char plen;

        unsigned char type;

        unsigned char version;

        rv = recv_data_full(conf, r, s, (char *)farray, AP_FCGI_HEADER_LEN);

        if (rv != APR_SUCCESS) {

            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

                          APLOGNO(02501) "%s: Error occurred before reading "

                          "entire header", fn);

            break;

        }

        ap_fcgi_header_fields_from_array(&version, &type, &rid, &clen, &plen,

                                         farray);

        if (version != AP_FCGI_VERSION_1) {

            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                          APLOGNO(02502) "%s: Got bogus FastCGI header "

                          "version %d", fn, (int)version);

            rv = APR_EINVAL;

            break;

        }

        if (rid != request_id) {

            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                          APLOGNO(02503) "%s: Got bogus FastCGI header "

                          "request id %d, expected %d",

                          fn, rid, request_id);

            rv = APR_EINVAL;

            break;

        }

    recv_again: /* if we need to keep reading more of a record's content */

        if (clen > sizeof(readbuf) - 1) {

            readbuflen = sizeof(readbuf) - 1;

        } else {

            readbuflen = clen;

        }

        /*

         * Now get the actual content of the record.

         */

        if (readbuflen != 0) {

            rv = recv_data(conf, r, s, readbuf, &readbuflen);

            if (rv != APR_SUCCESS) {

                break;

            }

            readbuf[readbuflen] = '\0';

        }

        switch (type) {

        case AP_FCGI_STDOUT: /* Response headers and optional body */

            if (clen != 0) {

                b = apr_bucket_transient_create(readbuf,

                                                readbuflen,

                                                r->connection->bucket_alloc);

                APR_BRIGADE_INSERT_TAIL(ob, b);

                if (!seen_end_of_headers) {

                    int st = handle_headers(r, &header_state,

                                            readbuf, readbuflen);

                    if (st == 1) {

                        int status;

                        seen_end_of_headers = 1;

                        status =

                            ap_scan_script_header_err_brigade_ex(r, ob,

                                                                 NULL, 

                                                                 APLOG_MODULE_INDEX);

                        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                                      APLOGNO(02504) "%s: script header "

                                      "parsing -> %d/%d",

                                      fn, status, r->status);

                        if (rspbuf) { /* caller wants to see response body,

                                       * if any

                                       */

                            apr_status_t tmprv;

                            if (rspbuflen) {

                                *rspbuflen = orspbuflen;

                            }

                            tmprv = apr_brigade_flatten(ob, rspbuf, rspbuflen);

                            if (tmprv != APR_SUCCESS) {

                                /* should not occur for these bucket types;

                                 * does not indicate overflow

                                 */

                                ap_log_rerror(APLOG_MARK, APLOG_ERR, tmprv, r,

                                              APLOGNO(02505) "%s: error "

                                              "flattening response body",

                                              fn);

                            }

                        }

                        if (status != OK) {

                            r->status = status;

                            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                                          APLOGNO(02506) "%s: Error parsing "

                                          "script headers from %s",

                                          fn, conf->backend);

                            rv = APR_EINVAL;

                            break;

                        }

                        apr_pool_clear(temp_pool);

                    }

                    else {

                        /* We're still looking for the end of the

                         * headers, so this part of the data will need

                         * to persist. */

                        apr_bucket_setaside(b, temp_pool);

                    }

                }

                /* If we didn't read all the data go back and get the

                 * rest of it. */

                if (clen > readbuflen) {

                    clen -= readbuflen;

                    goto recv_again;

                }

            }

            break;

        case AP_FCGI_STDERR: /* Text to log */

            if (clen) {

                ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,

                              APLOGNO(02507) "%s: Logged from %s: '%s'",

                              fn, conf->backend, readbuf);

            }

            if (clen > readbuflen) {

                clen -= readbuflen;

                goto recv_again; /* continue reading this record */

            }

            break;

        case AP_FCGI_END_REQUEST:

            done = 1;

            break;

        default:

            ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                          APLOGNO(02508) "%s: Got bogus FastCGI record type "

                          "%d", fn, type);

            break;

        }

        /* Leave on above switch's inner error. */

        if (rv != APR_SUCCESS) {

            break;

        }

        /*

         * Read/discard any trailing padding.

         */

        if (plen) {

            rv = recv_data_full(conf, r, s, readbuf, plen);

            if (rv != APR_SUCCESS) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

                              APLOGNO(02509) "%s: Error occurred reading "

                              "padding",

                              fn);

                break;

            }

        }

    }

    apr_brigade_cleanup(ob);

    if (rv == APR_SUCCESS && !seen_end_of_headers) {

        rv = APR_EINVAL;

        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                      APLOGNO(02510) "%s: Never reached end of script headers",

                      fn);

    }

    return rv;

}

/* almost from mod_fcgid */

static int mod_fcgid_modify_auth_header(void *vars,

                                        const char *key, const char *val)

{

    /* When the application gives a 200 response, the server ignores response

       headers whose names aren't prefixed with Variable- prefix, and ignores

       any response content */

    if (strncasecmp(key, "Variable-", 9) == 0)

        apr_table_setn(vars, key, val);

    return 1;

}

static int fix_auth_header(void *vr, const char *key, const char *val)

{

    request_rec *r = vr;

    ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r, "moving %s->%s", key, val);

    apr_table_unset(r->err_headers_out, key);

    apr_table_setn(r->subprocess_env, key + 9, val);

    return 1;

}

static void req_rsp(request_rec *r, const fcgi_provider_conf *conf,

                    const char *password, const char *apache_role,

                    char *rspbuf, apr_size_t *rspbuflen)

{

    const char *fn = "req_rsp";

    apr_pool_t *temp_pool;

    apr_size_t orspbuflen = 0;

    apr_socket_t *s;

    apr_status_t rv;

    apr_table_t *saved_subprocess_env = 

      apr_table_copy(r->pool, r->subprocess_env);

    if (rspbuflen) {

        orspbuflen = *rspbuflen;

        *rspbuflen = 0; /* unless we actually read something */

    }

    apr_pool_create(&temp_pool, r->pool);

    setupenv(r, password, apache_role);

    rv = connect_to_peer(&s, r, conf->backend_addrs,

                         conf->backend, FCGI_IO_TIMEOUT);

    if (rv == APR_SUCCESS) {

        apr_uint16_t request_id = 1;

        rv = send_begin_request(r, conf, s, AP_FCGI_AUTHORIZER, request_id);

        if (rv != APR_SUCCESS) {

            ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

                          APLOGNO(02511) "%s: Failed writing request to %s",

                          fn, conf->backend);

        }

        if (rv == APR_SUCCESS) {

            rv = send_environment(s, conf, r, request_id, temp_pool);

            if (rv != APR_SUCCESS) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

                              APLOGNO(02512) "%s: Failed writing environment "

                              "to %s", fn, conf->backend);

            }

        }

        /* The responder owns the request body, not the authorizer.

         * Don't even send an empty AP_FCGI_STDIN block.  libfcgi doesn't care,

         * but it wasn't sent to authorizers by mod_fastcgi or mod_fcgi and

         * may be unhandled by the app.  Additionally, the FastCGI spec does

         * not mention FCGI_STDIN in the Authorizer description, though it

         * does describe FCGI_STDIN elsewhere in more general terms than

         * simply a wrapper for the client's request body.

         */

        if (rv == APR_SUCCESS) {

            if (rspbuflen) {

                *rspbuflen = orspbuflen;

            }

            rv = handle_response(conf, r, s, temp_pool, request_id, rspbuf,

                                 rspbuflen);

            if (rv != APR_SUCCESS) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, rv, r,

                              APLOGNO(02514) "%s: Failed handling response "

                              "from %s", fn, conf->backend);

            }

        }

        apr_socket_close(s);

    }

    if (rv != APR_SUCCESS) {

        /* some sort of mechanical problem */

        r->status = HTTP_INTERNAL_SERVER_ERROR;

    }

    else {

        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                      APLOGNO(02515) "%s: Received HTTP status %d",

                      fn, r->status);

    }

    r->subprocess_env = saved_subprocess_env;

    if (r->status == HTTP_OK) {

        /* An Authorizer application's 200 response may include headers

         * whose names are prefixed with Variable-, and they should be

         * available to subsequent phases via subprocess_env (and yanked

         * from the client response).

         */

        apr_table_t *vars = apr_table_make(temp_pool, /* not used to allocate

                                                       * any values that end up

                                                       * in r->(anything)

                                                       */

                                           10);

        apr_table_do(mod_fcgid_modify_auth_header, vars,

                     r->err_headers_out, NULL);

        apr_table_do(fix_auth_header, r, vars, NULL);

    }

    apr_pool_destroy(temp_pool);

}

static int fcgi_check_authn(request_rec *r)

{

    const char *fn = "fcgi_check_authn";

    fcgi_dir_conf *dconf = ap_get_module_config(r->per_dir_config,

                                                &authnz_fcgi_module);

    const char *password = NULL;

    const fcgi_provider_conf *conf;

    const char *prov;

    const char *auth_type;

    char rspbuf[NON200_RESPONSE_BUF_LEN + 1]; /* extra byte for '\0' */

    apr_size_t rspbuflen = sizeof rspbuf - 1;

    int res;

    prov = dconf && dconf->name ? dconf->name : NULL;

    if (!prov || !strcasecmp(prov, "None")) {

        return DECLINED;

    }

    auth_type = ap_auth_type(r);

    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                  APLOGNO(02516) "%s, prov %s, authoritative %s, "

                  "require-basic %s, user expr? %s type %s",

                  fn, prov,

                  dconf->authoritative ? "yes" : "no",

                  dconf->require_basic_auth ? "yes" : "no",

                  dconf->user_expr ? "yes" : "no",

                  auth_type);

    if (auth_type && !strcasecmp(auth_type, "Basic")) {

        if ((res = ap_get_basic_auth_pw(r, &password))) {

            ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                          APLOGNO(02517) "%s: couldn't retrieve basic auth "

                          "password", fn);

            if (dconf->require_basic_auth) {

                return res;

            }

            password = NULL;

        }

    }

    conf = apr_hash_get(fcgi_authn_providers, prov, APR_HASH_KEY_STRING);

    if (!conf) {

        ap_log_rerror(APLOG_MARK, APLOG_CRIT, 0, r,

                      APLOGNO(02518) "%s: can't find config for provider %s",

                      fn, prov);

        return HTTP_INTERNAL_SERVER_ERROR;

    }

    if (APLOGrdebug(r)) {

        log_provider_info(conf, r);

    }

    req_rsp(r, conf, password, AP_FCGI_APACHE_ROLE_AUTHENTICATOR_STR,

            rspbuf, &rspbuflen);

    if (r->status == HTTP_OK) {

        if (dconf->user_expr) {

            const char *err;

            const char *user = ap_expr_str_exec(r, dconf->user_expr,

                                                &err;;

            if (user && strlen(user)) {

                r->user = apr_pstrdup(r->pool, user);

                ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,

                              APLOGNO(02519) "%s: Setting user to '%s'",

                              fn, r->user);

            }

            else if (user && dconf->default_user) {

                r->user = apr_pstrdup(r->pool, dconf->default_user);

            }

            else if (user) {

                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                              APLOGNO(02520) "%s: Failure extracting user "

                              "after calling authorizer: user expression "

                              "yielded empty string (variable not set?)",

                              fn);

                r->status = HTTP_INTERNAL_SERVER_ERROR;

            }

            else {

                /* unexpected error, not even an empty string was returned */

                ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

                              APLOGNO(02521) "%s: Failure extracting user "

                              "after calling authorizer: %s",