passenger 4.0.59 → 4.0.60

data/packaging/debian/debian_specs/nginx/modules/headers-more-nginx-module/util/build.sh

@@ -0,0 +1,32 @@
+#!/bin/bash
+
+# this file is mostly meant to be used by the author himself.
+
+root=`pwd`
+version=$1
+home=~
+force=$2
+
+        #--with-cc=gcc46 \
+
+ngx-build $force $version \
+        --with-ld-opt="-L$PCRE_LIB -Wl,-rpath,$PCRE_LIB:$LIBDRIZZLE_LIB:$LUAJIT_LIB:/usr/local/lib" \
+        --without-mail_pop3_module \
+        --without-mail_imap_module \
+        --without-mail_smtp_module \
+        --without-http_upstream_ip_hash_module \
+        --without-http_empty_gif_module \
+        --without-http_memcached_module \
+        --without-http_referer_module \
+        --without-http_autoindex_module \
+        --without-http_auth_basic_module \
+        --without-http_userid_module \
+        --with-http_realip_module \
+      --add-module=$root/../eval-nginx-module \
+      --add-module=$root/../lua-nginx-module \
+      --add-module=$root/../echo-nginx-module \
+      --add-module=$root $opts \
+      --with-debug
+      #--add-module=$root/../ndk-nginx-module \
+  #--without-http_ssi_module  # we cannot disable ssi because echo_location_async depends on it (i dunno why?!)
+

data/packaging/debian/debian_specs/nginx/modules/headers-more-nginx-module/valgrind.suppress

@@ -0,0 +1,215 @@
+{
+<insert_a_suppression_name_here>
+Memcheck:Cond
+fun:lj_str_new
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Cond
+   fun:lj_str_new
+   fun:lua_pushlstring
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Addr4
+   fun:lj_str_new
+   fun:lua_pushlstring
+}
+{
+<insert_a_suppression_name_here>
+Memcheck:Leak
+fun:malloc
+fun:ngx_alloc
+obj:*
+}
+{
+<insert_a_suppression_name_here>
+Memcheck:Leak
+fun:malloc
+fun:ngx_alloc
+}
+{
+<insert_a_suppression_name_here>
+Memcheck:Leak
+fun:malloc
+fun:ngx_alloc
+fun:ngx_palloc_large
+fun:ngx_palloc
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_calloc
+   fun:ngx_event_process_init
+}
+{
+<insert_a_suppression_name_here>
+Memcheck:Addr4
+fun:lj_str_new
+fun:lua_pushlstring
+fun:ngx_http_lua_get_output_header
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Addr4
+   fun:lj_str_new
+   fun:lua_getfield
+   fun:ngx_http_lua_cache_load_code
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Addr4
+   fun:lj_str_new
+   fun:lua_setfield
+   fun:ngx_http_lua_cache_store_code
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_event_process_init
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:(below main)
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Param
+   epoll_ctl(event)
+   fun:epoll_ctl
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_create_pool
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_malloc
+   fun:ngx_palloc_large
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Cond
+   fun:memcpy
+   fun:ngx_vslprintf
+   fun:ngx_log_error_core
+   fun:ngx_http_charset_header_filter
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_malloc
+   fun:ngx_pnalloc
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_malloc
+   fun:ngx_palloc
+}
+{
+   nginx-core-process-init
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_event_process_init
+}
+{
+   nginx-core-crc32-init
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_crc32_table_init
+   fun:main
+}
+{
+   palloc_large_for_init_request
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_palloc_large
+   fun:ngx_palloc
+   fun:ngx_pcalloc
+   fun:ngx_http_init_request
+   fun:ngx_epoll_process_events
+   fun:ngx_process_events_and_timers
+}
+{
+   palloc_large_for_create_temp_buf
+   Memcheck:Leak
+   fun:malloc
+   fun:ngx_alloc
+   fun:ngx_palloc_large
+   fun:ngx_palloc
+   fun:ngx_create_temp_buf
+   fun:ngx_http_init_request
+   fun:ngx_epoll_process_events
+   fun:ngx_process_events_and_timers
+}
+{
+   accept_create_pool
+   Memcheck:Leak
+   fun:memalign
+   fun:posix_memalign
+   fun:ngx_memalign
+   fun:ngx_create_pool
+   fun:ngx_event_accept
+   fun:ngx_epoll_process_events
+   fun:ngx_process_events_and_timers
+}
+{
+   create_pool_for_init_req
+   Memcheck:Leak
+   fun:memalign
+   fun:posix_memalign
+   fun:ngx_memalign
+   fun:ngx_create_pool
+   fun:ngx_http_init_request
+   fun:ngx_epoll_process_events
+   fun:ngx_process_events_and_timers
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Leak
+   fun:memalign
+   fun:posix_memalign
+   fun:ngx_memalign
+   fun:ngx_palloc_block
+   fun:ngx_palloc
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Addr8
+   fun:getenv
+   fun:gcov_exit
+   fun:exit
+   fun:ngx_master_process_exit
+}
+{
+   <insert_a_suppression_name_here>
+   Memcheck:Cond
+   fun:index
+   fun:expand_dynamic_string_token
+   fun:_dl_map_object
+   fun:map_doit
+   fun:_dl_catch_error
+   fun:do_preload
+   fun:dl_main
+}

data/packaging/debian/debian_specs/nginx/modules/nginx-auth-pam/ChangeLog

@@ -0,0 +1,35 @@
+2015-02-04  sto@iti.es
+
+	* Version 1.4.
+	* Cleanup PAM responses on error, the module was not doing it, causing
+	  memory leaks (thanks to Michael Koziarski for the report).
+
+2013-09-17  sto@iti.es
+
+	* Version 1.3.
+	* Added support to export HOST and REQUEST variables to the PAM ENVIRONMENT.
+	  Thanks to Ruben Jenster for the  initial patch, his version is available
+	  from https://github.com/r10r/ngx_http_auth_pam_module; my version uses his
+	  implementation but only if the user sets the ``pam_auth_set_pam_env``
+	  flag.
+	* Fixed bug from http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=+721702
+	  (ngx_module_t commands array should end with a ngx_null_command); the bug
+	  was already fixed on the PAM_ENV patch, but I forgot about it until I went
+	  back to my svn repository to add the debian patch... better latter than
+	  never... ;)
+
+2010-11-15  sto@iti.upv.es
+
+	* Version 1.2.
+	* Fixed possible memory leak when authentication fails, pam_end has to
+	  be called to free memory (thanks to Neil Chintomby).
+
+2009-01-26  sto@iti.upv.es
+
+	* Version 1.1.
+	* Fixed ngx_log_debugX calls, no we use the correct X value on each
+	  call.
+
+2008-09-17  sto@iti.upv.es
+
+	* Initial version (1.0).

data/packaging/debian/debian_specs/nginx/modules/nginx-auth-pam/LICENSE

@@ -0,0 +1,25 @@
+/* 
+ * Copyright (C) 2008-2015 Sergio Talens Oliag
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ */

data/packaging/debian/debian_specs/nginx/modules/nginx-auth-pam/README.md

@@ -0,0 +1,93 @@
+# ngx_http_auth_pam_module
+
+## Nginx module to use PAM for simple http authentication
+
+### Compilation
+
+When compiling from source build as usual adding the -add-module option:
+
+	./configure --add-module=$PATH_TO_MODULE
+
+If you are using a Debian GNU/Linux distribution install the nginx-full package;
+the module has been included in the nginx debian package since version 1.1.6-1
+and there are newer packages on the stable distribution (wheezy) and the wheezy
+version is also available from the oldstable backports repository
+(squeeze-backports).
+
+### Configuration
+
+The module only has two directives:
+
+- ``auth_pam``: This is the http authentication realm. If given the value
+  ``off`` the module is disabled (needed when we want to override the value
+  set on a lower-level directive).
+
+- ``auth_pam_service_name``: this is the PAM service name and by default it is
+  set to ``nginx``.
+
+### Examples
+
+To protect everything under ``/secure`` you will add the following to the
+``nginx.conf`` file:
+
+	location /secure {
+	    auth_pam              "Secure Zone";
+	    auth_pam_service_name "nginx";
+	}
+
+Note that the module runs as the web server user, so the PAM modules used must
+be able to authenticate the users without being root; that means that if you
+want to use the ``pam_unix.so`` module to autenticate users you need to let the
+web server user to read the ``/etc/shadow`` file if that does not scare you (on
+Debian like systems you can add the ``www-data`` user to the ``shadow`` group).
+
+As an example, to authenticate users against an LDAP server (using the
+``pam_ldap.so`` module) you will use an ``/etc/pam.d/nginx`` like the
+following:
+
+	auth    required     /lib/security/pam_ldap.so
+	account required     /lib/security/pam_ldap.so
+
+If you also want to limit the users from LDAP that can authenticate you can
+use the ``pam_listfile.so`` module; to limit who can access resources under
+``/restricted`` add the following to the ``nginx.conf`` file:
+
+	location /restricted {
+	    auth_pam              "Restricted Zone";
+	    auth_pam_service_name "nginx_restricted";
+	}
+
+Use the following ``/etc/pam.d/nginx_restricted`` file:
+
+	auth    required     /lib/security/pam_listfile.so onerr=fail item=user \
+	                     sense=allow file=/etc/nginx/restricted_users
+	auth    required     /lib/security/pam_ldap.so
+	account required     /lib/security/pam_ldap.so
+
+And add the users allowed to authenticate to the ``/etc/nginx/restricted_users``
+(remember that the web server user has to be able to read this file).
+
+### PAM Environment
+
+If you want use the ``pam_exec.so`` plugin for request based authentication the
+module can add to the PAM environment the ``HOST`` and ``REQUEST`` variables if
+you set the ``auth_pam_set_pam_env`` flag::
+
+  location /pam_exec_protected {
+    auth_pam              "Exec Zone";
+    auth_pam_service_name "nginx_exec";
+    auth_pam_set_pam_env  on;
+  }
+
+With this configuration if you access an URL like:
+
+	http://localhost:8000/pam_exec_protected/page?foo=yes&bar=too
+
+the PAM environment will include the following variables:
+
+	HOST=localhost:8000
+	REQUEST=GET /pam_exec_protected/page?foo=yes&bar=too HTTP/1.1
+
+You may use this information for request based authentication.
+You need a recent pam release (>= version 1.0.90) to expose environment
+variables to pam_exec.

data/packaging/debian/debian_specs/nginx/modules/nginx-auth-pam/config

@@ -0,0 +1,4 @@
+ngx_addon_name=ngx_http_auth_pam_module
+HTTP_MODULES="$HTTP_MODULES ngx_http_auth_pam_module"
+NGX_ADDON_SRCS="$NGX_ADDON_SRCS $ngx_addon_dir/ngx_http_auth_pam_module.c"
+CORE_LIBS="$CORE_LIBS -lpam"

data/packaging/debian/debian_specs/nginx/modules/nginx-auth-pam/ngx_http_auth_pam_module.c

@@ -0,0 +1,462 @@
+/*
+ * Copyright (C) 2008-2015 Sergio Talens-Oliag <sto@iti.es>
+ *
+ * Based on nginx's 'ngx_http_auth_basic_module.c' by Igor Sysoev and apache's
+ * 'mod_auth_pam.c' by Ingo Luetkebolhe.
+ *
+ * File: ngx_http_auth_pam_module.c
+ */
+
+#include <ngx_config.h>
+#include <ngx_core.h>
+#include <ngx_http.h>
+#include <security/pam_appl.h>
+
+#define NGX_PAM_SERVICE_NAME    "nginx"
+
+/* Module context data */
+typedef struct {
+    ngx_str_t  passwd;
+} ngx_http_auth_pam_ctx_t;
+
+/* PAM userinfo */
+typedef struct {
+    ngx_str_t  username;
+    ngx_str_t  password;
+} ngx_pam_userinfo;
+
+/* Module configuration struct */
+typedef struct {
+    ngx_str_t   realm;          /* http basic auth realm */
+    ngx_str_t   service_name;   /* pam service name */
+    ngx_flag_t  set_pam_env;    /* flag that indicates if we should export
+                                   variables to PAM or NOT */
+} ngx_http_auth_pam_loc_conf_t;
+
+/* Module handler */
+static ngx_int_t ngx_http_auth_pam_handler(ngx_http_request_t *r);
+
+/* Function that authenticates the user -- is the only function that uses PAM */
+static ngx_int_t ngx_http_auth_pam_authenticate(ngx_http_request_t *r,
+                                                ngx_http_auth_pam_ctx_t *ctx,
+                                                ngx_str_t *passwd, void *conf);
+
+static ngx_int_t ngx_http_auth_pam_set_realm(ngx_http_request_t *r,
+                                             ngx_str_t *realm);
+
+static void *ngx_http_auth_pam_create_loc_conf(ngx_conf_t *cf);
+
+static char *ngx_http_auth_pam_merge_loc_conf(ngx_conf_t *cf,
+                                              void *parent, void *child);
+
+static ngx_int_t ngx_http_auth_pam_init(ngx_conf_t *cf);
+
+static char *ngx_http_auth_pam(ngx_conf_t *cf, void *post, void *data);
+
+static ngx_conf_post_handler_pt  ngx_http_auth_pam_p = ngx_http_auth_pam;
+
+static int ngx_auth_pam_talker(int num_msg, const struct pam_message ** msg,
+                               struct pam_response ** resp, void *appdata_ptr);
+
+static ngx_command_t  ngx_http_auth_pam_commands[] = {
+
+    { ngx_string("auth_pam"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
+                        |NGX_CONF_TAKE1,
+      ngx_conf_set_str_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_auth_pam_loc_conf_t, realm),
+      &ngx_http_auth_pam_p },
+
+    { ngx_string("auth_pam_service_name"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
+                        |NGX_CONF_TAKE1,
+      ngx_conf_set_str_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_auth_pam_loc_conf_t, service_name),
+      NULL },
+
+    { ngx_string("auth_pam_set_pam_env"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_HTTP_LMT_CONF
+                        |NGX_CONF_FLAG,
+      ngx_conf_set_flag_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_auth_pam_loc_conf_t, set_pam_env),
+      NULL },
+
+    ngx_null_command
+};
+
+
+static ngx_http_module_t  ngx_http_auth_pam_module_ctx = {
+    NULL,                                  /* preconfiguration */
+    ngx_http_auth_pam_init,                /* postconfiguration */
+
+    NULL,                                  /* create main configuration */
+    NULL,                                  /* init main configuration */
+
+    NULL,                                  /* create server configuration */
+    NULL,                                  /* merge server configuration */
+
+    ngx_http_auth_pam_create_loc_conf,     /* create location configuration */
+    ngx_http_auth_pam_merge_loc_conf       /* merge location configuration */
+};
+
+
+ngx_module_t  ngx_http_auth_pam_module = {
+    NGX_MODULE_V1,
+    &ngx_http_auth_pam_module_ctx,         /* module context */
+    ngx_http_auth_pam_commands,            /* module directives */
+    NGX_HTTP_MODULE,                       /* module type */
+    NULL,                                  /* init master */
+    NULL,                                  /* init module */
+    NULL,                                  /* init process */
+    NULL,                                  /* init thread */
+    NULL,                                  /* exit thread */
+    NULL,                                  /* exit process */
+    NULL,                                  /* exit master */
+    NGX_MODULE_V1_PADDING
+};
+
+
+/* 
+ * Function to free PAM_CONV responses if an error is returned.
+ */
+static void
+free_resp(int num_msg, struct pam_response *response)
+{
+    int i;
+    if (response == NULL)
+        return;
+    for (i = 0; i < num_msg; i++) {
+        if (response[i].resp) {
+            /* clear before freeing -- may be a password */
+            bzero(response[i].resp, strlen(response[i].resp));
+            free(response[i].resp);
+            response[i].resp = NULL;
+        }
+    }
+    free(response);
+}
+
+/*
+ * ngx_auth_pam_talker: supply authentication information to PAM when asked
+ *
+ * Assumptions:
+ *   A password is asked for by requesting input without echoing
+ *   A username is asked for by requesting input _with_ echoing
+ */
+static int
+ngx_auth_pam_talker(int num_msg, const struct pam_message ** msg,
+                    struct pam_response ** resp, void *appdata_ptr)
+{
+    int  i;
+    ngx_pam_userinfo  *uinfo;
+    struct pam_response  *response;
+
+    uinfo = (ngx_pam_userinfo *) appdata_ptr;
+    response = NULL;
+
+    /* parameter sanity checking */
+    if (!resp || !msg || !uinfo)
+        return PAM_CONV_ERR;
+
+    /* allocate memory to store response */
+    response = malloc(num_msg * sizeof(struct pam_response));
+    if (!response)
+        return PAM_CONV_ERR;
+
+    /* copy values */
+    for (i = 0; i < num_msg; i++) {
+        /* initialize to safe values */
+        response[i].resp_retcode = 0;
+        response[i].resp = 0;
+
+        /* select response based on requested output style */
+        switch (msg[i]->msg_style) {
+        case PAM_PROMPT_ECHO_ON:
+            /* on memory allocation failure, auth fails */
+            response[i].resp = strdup((const char *)uinfo->username.data);
+            break;
+        case PAM_PROMPT_ECHO_OFF:
+            response[i].resp = strdup((const char *)uinfo->password.data);
+            break;
+        default:
+            free_resp(i, response);
+            return PAM_CONV_ERR;
+        }
+    }
+    /* everything okay, set PAM response values */
+    *resp = response;
+    return PAM_SUCCESS;
+}
+
+static ngx_int_t
+ngx_http_auth_pam_handler(ngx_http_request_t *r)
+{
+    ngx_int_t  rc;
+    ngx_http_auth_pam_ctx_t  *ctx;
+    ngx_http_auth_pam_loc_conf_t  *alcf;
+
+    alcf = ngx_http_get_module_loc_conf(r, ngx_http_auth_pam_module);
+
+    if (alcf->realm.len == 0) {
+        return NGX_DECLINED;
+    }
+
+    ctx = ngx_http_get_module_ctx(r, ngx_http_auth_pam_module);
+
+    if (ctx) {
+        return ngx_http_auth_pam_authenticate(r, ctx, &ctx->passwd, alcf);
+    }
+
+    /* Decode http auth user and passwd, leaving values on the request */
+    rc = ngx_http_auth_basic_user(r);
+
+    if (rc == NGX_DECLINED) {
+        return ngx_http_auth_pam_set_realm(r, &alcf->realm);
+    }
+
+    if (rc == NGX_ERROR) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    /* Check user & password using PAM */
+    return ngx_http_auth_pam_authenticate(r, ctx, &ctx->passwd, alcf);
+}
+
+/**
+ * create a key value pair from the given key and value string
+ */
+static void set_to_pam_env(pam_handle_t *pamh, ngx_http_request_t *r,
+                           char *key, char *value)
+{
+        if (key != NULL && value != NULL) {
+                size_t size = strlen(key) + strlen(value) + 1 * sizeof(char);
+                char *key_value_pair = ngx_palloc(r->pool, size);
+                sprintf(key_value_pair, "%s=%s", key, value);
+
+                pam_putenv(pamh, key_value_pair);
+        }
+}
+
+/**
+ * creates a '\0' terminated string from the given ngx_str_t
+ *
+ * @param source nginx string structure with data and length
+ * @param pool pool of the request used for memory allocation
+ */
+static char* ngx_strncpy_s(ngx_str_t source, ngx_pool_t *pool)
+{
+        // allocate memory in pool
+        char* destination = ngx_palloc(pool, source.len + 1);
+        strncpy(destination, (char *) source.data, source.len);
+        // add null terminator
+        destination[source.len] = '\0';
+        return destination;
+}
+
+/**
+ * enrich pam environment with request parameters
+ */
+static void add_request_info_to_pam_env(pam_handle_t *pamh,
+                                        ngx_http_request_t *r)
+{
+        char *request_info = ngx_strncpy_s(r->request_line, r->pool);
+        char *host_info = ngx_strncpy_s(r->headers_in.host->value, r->pool);
+
+        set_to_pam_env(pamh, r, "REQUEST", request_info);
+        set_to_pam_env(pamh, r, "HOST", host_info);
+}
+
+static ngx_int_t
+ngx_http_auth_pam_authenticate(ngx_http_request_t *r,
+                               ngx_http_auth_pam_ctx_t *ctx, ngx_str_t *passwd,
+                               void *conf)
+{
+    ngx_int_t   rc;
+    ngx_http_auth_pam_loc_conf_t  *alcf;
+
+    ngx_pam_userinfo  uinfo;
+    struct pam_conv   conv_info;        /* PAM struct */
+    pam_handle_t      *pamh;
+    u_char            *service_name;
+
+    alcf = conf;
+
+    size_t   len;
+    u_char  *uname_buf, *p;
+
+    /**
+     * Get username and password, note that r->headers_in.user contains the
+     * string 'user:pass', so we need to copy the username
+     **/
+    for (len = 0; len < r->headers_in.user.len; len++) {
+        if (r->headers_in.user.data[len] == ':') {
+            break;
+        }
+    }
+    uname_buf = ngx_palloc(r->pool, len+1);
+    if (uname_buf == NULL) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+    p = ngx_cpymem(uname_buf, r->headers_in.user.data , len);
+    *p ='\0';
+
+    uinfo.username.data = uname_buf;
+    uinfo.username.len  = len;
+
+    uinfo.password.data = r->headers_in.passwd.data;
+    uinfo.password.len  = r->headers_in.passwd.len;
+
+    conv_info.conv = &ngx_auth_pam_talker;
+    conv_info.appdata_ptr = (void *) &uinfo;
+
+    pamh = NULL;
+
+    /* Initialize PAM */
+    if (alcf->service_name.data == NULL) {
+        service_name = (u_char *) NGX_PAM_SERVICE_NAME;
+    } else {
+        service_name = alcf->service_name.data;
+    }
+    if ((rc = pam_start((const char *) service_name,
+                        (const char *) uinfo.username.data,
+                        &conv_info,
+                        &pamh)) != PAM_SUCCESS) {
+        ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                      "PAM: Could not start pam service: %s",
+                      pam_strerror(pamh, rc));
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    if (alcf->set_pam_env) {
+        add_request_info_to_pam_env(pamh, r);
+    }
+
+    /* try to authenticate user, log error on failure */
+    if ((rc = pam_authenticate(pamh,
+                               PAM_DISALLOW_NULL_AUTHTOK)) != PAM_SUCCESS) {
+        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                      "PAM: user '%s' - not authenticated: %s",
+                      uinfo.username.data, pam_strerror(pamh, rc));
+        pam_end(pamh, PAM_SUCCESS);
+        return ngx_http_auth_pam_set_realm(r, &alcf->realm);
+    }   /* endif authenticate */
+
+    /* check that the account is healthy */
+    if ((rc = pam_acct_mgmt(pamh, PAM_DISALLOW_NULL_AUTHTOK)) != PAM_SUCCESS) {
+        ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
+                      "PAM: user '%s'  - invalid account: %s",
+                      uinfo.username.data, pam_strerror(pamh, rc));
+        pam_end(pamh, PAM_SUCCESS);
+        return ngx_http_auth_pam_set_realm(r, &alcf->realm);
+    }
+
+    pam_end(pamh, PAM_SUCCESS);
+    return NGX_OK;
+}
+
+static ngx_int_t
+ngx_http_auth_pam_set_realm(ngx_http_request_t *r, ngx_str_t *realm)
+{
+    r->headers_out.www_authenticate = ngx_list_push(&r->headers_out.headers);
+    if (r->headers_out.www_authenticate == NULL) {
+        return NGX_HTTP_INTERNAL_SERVER_ERROR;
+    }
+
+    r->headers_out.www_authenticate->hash = 1;
+    r->headers_out.www_authenticate->key.len = sizeof("WWW-Authenticate") - 1;
+    r->headers_out.www_authenticate->key.data = (u_char *) "WWW-Authenticate";
+    r->headers_out.www_authenticate->value = *realm;
+
+    return NGX_HTTP_UNAUTHORIZED;
+}
+
+static void *
+ngx_http_auth_pam_create_loc_conf(ngx_conf_t *cf)
+{
+    ngx_http_auth_pam_loc_conf_t *conf;
+
+    conf = ngx_pcalloc(cf->pool, sizeof(ngx_http_auth_pam_loc_conf_t));
+    if (conf == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    /* Strings are already NULL, but the flags have to be marked as unset */
+    conf->set_pam_env = NGX_CONF_UNSET;
+
+    return conf;
+}
+
+static char *
+ngx_http_auth_pam_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
+{
+    ngx_http_auth_pam_loc_conf_t  *prev = parent;
+    ngx_http_auth_pam_loc_conf_t  *conf = child;
+
+    if (conf->realm.data == NULL) {
+        conf->realm = prev->realm;
+    }
+
+    if (conf->service_name.data == NULL) {
+        conf->service_name = prev->service_name;
+    }
+
+    /* By default set_pam_env is off */
+    ngx_conf_merge_value(conf->set_pam_env, prev->set_pam_env, 0);
+
+    return NGX_CONF_OK;
+}
+
+static ngx_int_t
+ngx_http_auth_pam_init(ngx_conf_t *cf)
+{
+    ngx_http_handler_pt        *h;
+    ngx_http_core_main_conf_t  *cmcf;
+
+    cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);
+
+    h = ngx_array_push(&cmcf->phases[NGX_HTTP_ACCESS_PHASE].handlers);
+    if (h == NULL) {
+        return NGX_ERROR;
+    }
+
+    *h = ngx_http_auth_pam_handler;
+
+    return NGX_OK;
+}
+
+static char *
+ngx_http_auth_pam(ngx_conf_t *cf, void *post, void *data)
+{
+    ngx_str_t  *realm = data;
+
+    size_t   len;
+    u_char  *basic, *p;
+
+    if (ngx_strcmp(realm->data, "off") == 0) {
+        realm->len = 0;
+        realm->data = (u_char *) "";
+
+        return NGX_CONF_OK;
+    }
+
+    len = sizeof("Basic realm=\"") - 1 + realm->len + 1;
+
+    basic = ngx_palloc(cf->pool, len);
+    if (basic == NULL) {
+        return NGX_CONF_ERROR;
+    }
+
+    p = ngx_cpymem(basic, "Basic realm=\"", sizeof("Basic realm=\"") - 1);
+    p = ngx_cpymem(p, realm->data, realm->len);
+    *p = '"';
+
+    realm->len = len;
+    realm->data = basic;
+
+    return NGX_CONF_OK;
+}
+
+/* File: ngx_http_auth_pam_module.c */