-------------------------
Anti Tamper Module for Apache 2.x

Version 0.1 Beta Experimental.

Copyright (c) 2005 Stefano Di Paola 
Released under GPL 2.0
-------------------------

==What Is AntiTamper (AT)

AntiTamper is an Apache 2.x module that could be used to
prevent some sort of url and cookie tampering.

In particular, AT could stop a lot of those malicious bots that take
advantage from search engines.
Moreover, attack techniques like Http Response Splitting and session 
hijacking/fixation will be mitigated.

For a quick and dirty start go to examples/README.

Is important to notice that mod_anti_tamper is not an altrernative to mod_security,
which is more exaustive and uselful for all web situation.
AT could be a complement to mod_security.


==Introduction 

- What is HMAC
HMAC is a validation algorithm to check the integrity of informations coupled with
a secret password.
http://www.faqs.org/rfcs/rfc2104.html

AT will automatically generate a password and will save it in a 'safe' place
(root owner with 600 mode).


==How it works

AT is composed by two primary active components.

1. A filter for url links integrity check.
2. A filter for cookie integrity check.

--The Url Filter
<preliminary statement>
  At the moment url filtering is applied only if:
  1. a query string is appended to url (eg. "address?query")

  2. Apache server name is the same of the name on the url (Virtual servers)
      (eg. "http://www.wisec.it/testpage.php?id=2" on server www.wisec.it)

  3. Url is a relative url on server
     (eg. "/testpage.php?id=2")

  4. Method is GET.

</preliminary statement>

AT Filter and parses html output and appends to URIs a computed HMAC.



--The Cookie Filter
AT Filter intercepts Cookies from and to apache.
If the cookie is from Apache, then appends the HMAC to it and sends it to client.

Apache -> Cookie -> Mod_Anti_Tamper -> Cookie:auth=421543254325 -> Client.

If the cookie is from a client, then AT controls the HMAC and if it does not match to the one
embedded in the cookie, the cookie is dropped, else the authorization is stripped and the cookie is considered
"trusted" and forwaded to the other Apache modules.

Client -> CookieValue:auth=421543254325 -> Mod_Anti_Tamper --(is it ok?)-> Yes! -> Cookie -> Apache
                                                                        \
                                                                         \-> No! -> Remove Cookie, continue request.



==Configuration Settings.

ATHmacUrl [On|Off] 
Set url anti tamper filter ON 

ATHmacCookie [On|Off]
Set cookie anti tamper filter ON


ATHmacUseIP [URL|COOKIE|BOTH|NONE] 
Add source IP to HMAC computation for respectively url,cookie,both or none


ATSetHmacURLLibrary <full_path_solib> <exported_function> <authlen> 
Function takes aguments 
char *exported_function ( request_rec *r , char *data,int data_len, const unsigned char *key,int key_len) 


ATSetHmacCookieLibrary <full_path_solib> <exported_function> <authlen>
Function takes aguments 
char *exported_function ( request_rec *r , char *data,int data_len, const unsigned char *key,int key_len) 


ATExcludeArgsForUri [GET|POST|BOTH] arg1|arg2... 
The arguments listed here (and their value) will be excluded when computing the hmac.


ATRedirect_url <url>

ATSetHMACPrefix <prefix>
Default is '_auth but' it could be changed (use A-Za-z0-9 subset).

ATSetDontModifyPrefix <prefix> 
Default is 'dontmodify' but it could be changed (use A-Za-z0-9 subset).
