Diff for /loncom/lond between versions 1.190 and 1.214

version 1.190, 2004/05/11 19:51:49 version 1.214, 2004/07/27 11:10:47
Line 45  use Authen::Krb4; Line 45  use Authen::Krb4;
 use Authen::Krb5;  use Authen::Krb5;
 use lib '/home/httpd/lib/perl/';  use lib '/home/httpd/lib/perl/';
 use localauth;  use localauth;
   use localenroll;
 use File::Copy;  use File::Copy;
 use LONCAPA::ConfigFileEdit;  use LONCAPA::ConfigFileEdit;
   use LONCAPA::lonlocal;
   use LONCAPA::lonssl;
   
 my $DEBUG = 0;       # Non zero to enable debug log entries.  my $DEBUG = 0;       # Non zero to enable debug log entries.
   
Line 55  my $lastlog=''; Line 58  my $lastlog='';
   
 my $VERSION='$Revision$'; #' stupid emacs  my $VERSION='$Revision$'; #' stupid emacs
 my $remoteVERSION;  my $remoteVERSION;
 my $currenthostid;  my $currenthostid="default";
 my $currentdomainid;  my $currentdomainid;
   
 my $client;  my $client;
 my $clientip;  my $clientip; # IP address of client.
 my $clientname;  my $clientdns; # DNS name of client.
   my $clientname; # LonCAPA name of client.
   
 my $server;  my $server;
 my $thisserver;  my $thisserver; # DNS of us.
   
   my $keymode;
   
   my $cipher; # Cipher key negotiated with client
   my $tmpsnum = 0; # Id of tmpputs.
   
 #   # 
 #   Connection type is:  #   Connection type is:
Line 74  my $thisserver; Line 83  my $thisserver;
   
 my $ConnectionType;  my $ConnectionType;
   
 my %hostid;  my %hostid; # ID's for hosts in cluster by ip.
 my %hostdom;  my %hostdom; # LonCAPA domain for hosts in cluster.
 my %hostip;  my %hostip; # IPs for hosts in cluster.
   my %hostdns; # ID's of hosts looked up by DNS name.
   
 my %managers; # Ip -> manager names  my %managers; # Ip -> manager names
   
 my %perlvar; # Will have the apache conf defined perl vars.  my %perlvar; # Will have the apache conf defined perl vars.
   
 #  #
   #   The hash below is used for command dispatching, and is therefore keyed on the request keyword.
   #    Each element of the hash contains a reference to an array that contains:
   #          A reference to a sub that executes the request corresponding to the keyword.
   #          A flag that is true if the request must be encoded to be acceptable.
   #          A mask with bits as follows:
   #                      CLIENT_OK    - Set when the function is allowed by ordinary clients
   #                      MANAGER_OK   - Set when the function is allowed to manager clients.
   #
   my $CLIENT_OK  = 1;
   my $MANAGER_OK = 2;
   my %Dispatcher;
   
   
   #
 #  The array below are password error strings."  #  The array below are password error strings."
 #  #
 my $lastpwderror    = 13; # Largest error number from lcpasswd.  my $lastpwderror    = 13; # Largest error number from lcpasswd.
Line 120  my @adderrors    = ("ok", Line 144  my @adderrors    = ("ok",
     "lcuseradd Password mismatch");      "lcuseradd Password mismatch");
   
   
   
   #
   #   Statistics that are maintained and dislayed in the status line.
   #
   my $Transactions = 0; # Number of attempted transactions.
   my $Failures     = 0; # Number of transcations failed.
   
   #   ResetStatistics: 
   #      Resets the statistics counters:
   #
   sub ResetStatistics {
       $Transactions = 0;
       $Failures     = 0;
   }
   
   
   
   #------------------------------------------------------------------------
   #
   #   LocalConnection
   #     Completes the formation of a locally authenticated connection.
   #     This function will ensure that the 'remote' client is really the
   #     local host.  If not, the connection is closed, and the function fails.
   #     If so, initcmd is parsed for the name of a file containing the
   #     IDEA session key.  The fie is opened, read, deleted and the session
   #     key returned to the caller.
   #
   # Parameters:
   #   $Socket      - Socket open on client.
   #   $initcmd     - The full text of the init command.
   #
   # Implicit inputs:
   #    $clientdns  - The DNS name of the remote client.
   #    $thisserver - Our DNS name.
   #
   # Returns:
   #     IDEA session key on success.
   #     undef on failure.
   #
   sub LocalConnection {
       my ($Socket, $initcmd) = @_;
       Debug("Attempting local connection: $initcmd client: $clientdns me: $thisserver");
       if($clientdns ne $thisserver) {
    &logthis('<font color="red"> LocalConnection rejecting non local: '
    ."$clientdns ne $thisserver </font>");
    close $Socket;
    return undef;
       } 
       else {
    chomp($initcmd); # Get rid of \n in filename.
    my ($init, $type, $name) = split(/:/, $initcmd);
    Debug(" Init command: $init $type $name ");
   
    # Require that $init = init, and $type = local:  Otherwise
    # the caller is insane:
   
    if(($init ne "init") && ($type ne "local")) {
       &logthis('<font color = "red"> LocalConnection: caller is insane! '
        ."init = $init, and type = $type </font>");
       close($Socket);;
       return undef;
   
    }
    #  Now get the key filename:
   
    my $IDEAKey = lonlocal::ReadKeyFile($name);
    return $IDEAKey;
       }
   }
   #------------------------------------------------------------------------------
   #
   #  SSLConnection
   #   Completes the formation of an ssh authenticated connection. The
   #   socket is promoted to an ssl socket.  If this promotion and the associated
   #   certificate exchange are successful, the IDEA key is generated and sent
   #   to the remote peer via the SSL tunnel. The IDEA key is also returned to
   #   the caller after the SSL tunnel is torn down.
   #
   # Parameters:
   #   Name              Type             Purpose
   #   $Socket          IO::Socket::INET  Plaintext socket.
   #
   # Returns:
   #    IDEA key on success.
   #    undef on failure.
   #
   sub SSLConnection {
       my $Socket   = shift;
   
       Debug("SSLConnection: ");
       my $KeyFile         = lonssl::KeyFile();
       if(!$KeyFile) {
    my $err = lonssl::LastError();
    &logthis("<font color=\"red\"> CRITICAL"
    ."Can't get key file $err </font>");
    return undef;
       }
       my ($CACertificate,
    $Certificate) = lonssl::CertificateFile();
   
   
       # If any of the key, certificate or certificate authority 
       # certificate filenames are not defined, this can't work.
   
       if((!$Certificate) || (!$CACertificate)) {
    my $err = lonssl::LastError();
    &logthis("<font color=\"red\"> CRITICAL"
    ."Can't get certificates: $err </font>");
   
    return undef;
       }
       Debug("Key: $KeyFile CA: $CACertificate Cert: $Certificate");
   
       # Indicate to our peer that we can procede with
       # a transition to ssl authentication:
   
       print $Socket "ok:ssl\n";
   
       Debug("Approving promotion -> ssl");
       #  And do so:
   
       my $SSLSocket = lonssl::PromoteServerSocket($Socket,
    $CACertificate,
    $Certificate,
    $KeyFile);
       if(! ($SSLSocket) ) { # SSL socket promotion failed.
    my $err = lonssl::LastError();
    &logthis("<font color=\"red\"> CRITICAL "
    ."SSL Socket promotion failed: $err </font>");
    return undef;
       }
       Debug("SSL Promotion successful");
   
       # 
       #  The only thing we'll use the socket for is to send the IDEA key
       #  to the peer:
   
       my $Key = lonlocal::CreateCipherKey();
       print $SSLSocket "$Key\n";
   
       lonssl::Close($SSLSocket); 
   
       Debug("Key exchange complete: $Key");
   
       return $Key;
   }
   #
   #     InsecureConnection: 
   #        If insecure connections are allowd,
   #        exchange a challenge with the client to 'validate' the
   #        client (not really, but that's the protocol):
   #        We produce a challenge string that's sent to the client.
   #        The client must then echo the challenge verbatim to us.
   #
   #  Parameter:
   #      Socket      - Socket open on the client.
   #  Returns:
   #      1           - success.
   #      0           - failure (e.g.mismatch or insecure not allowed).
   #
   sub InsecureConnection {
       my $Socket  =  shift;
   
       #   Don't even start if insecure connections are not allowed.
   
       if(! $perlvar{londAllowInsecure}) { # Insecure connections not allowed.
    return 0;
       }
   
       #   Fabricate a challenge string and send it..
   
       my $challenge = "$$".time; # pid + time.
       print $Socket "$challenge\n";
       &status("Waiting for challenge reply");
   
       my $answer = <$Socket>;
       $answer    =~s/\W//g;
       if($challenge eq $answer) {
    return 1;
       } 
       else {
    logthis("<font color='blue'>WARNING client did not respond to challenge</font>");
    &status("No challenge reqply");
    return 0;
       }
       
   
   }
   
 #  #
 #   GetCertificate: Given a transaction that requires a certificate,  #   GetCertificate: Given a transaction that requires a certificate,
 #   this function will extract the certificate from the transaction  #   this function will extract the certificate from the transaction
Line 175  sub ReadManagerTable { Line 388  sub ReadManagerTable {
    while(my $host = <MANAGERS>) {     while(my $host = <MANAGERS>) {
       chomp($host);        chomp($host);
       if ($host =~ "^#") {                  # Comment line.        if ($host =~ "^#") {                  # Comment line.
          logthis('<font color="green"> Skipping line: '. "$host</font>\n");  
          next;           next;
       }        }
       if (!defined $hostip{$host}) { # This is a non cluster member        if (!defined $hostip{$host}) { # This is a non cluster member
Line 225  sub ValidManager { Line 437  sub ValidManager {
 #     1   - Success.  #     1   - Success.
 #  #
 sub CopyFile {  sub CopyFile {
     my $oldfile = shift;  
     my $newfile = shift;      my ($oldfile, $newfile) = @_;
   
     #  The file must exist:      #  The file must exist:
   
Line 326  sub AdjustHostContents { Line 538  sub AdjustHostContents {
 #      0       - failure and $! has an errno.  #      0       - failure and $! has an errno.
 #  #
 sub InstallFile {  sub InstallFile {
     my $Filename = shift;  
     my $Contents = shift;      my ($Filename, $Contents) = @_;
     my $TempFile = $Filename.".tmp";      my $TempFile = $Filename.".tmp";
   
     #  Open the file for write:      #  Open the file for write:
Line 350  sub InstallFile { Line 562  sub InstallFile {
   
     return 1;      return 1;
 }  }
   
   
 #  #
 #   ConfigFileFromSelector: converts a configuration file selector  #   ConfigFileFromSelector: converts a configuration file selector
 #                 (one of host or domain at this point) into a   #                 (one of host or domain at this point) into a 
Line 564  sub isValidEditCommand { Line 778  sub isValidEditCommand {
 #                  file being edited.  #                  file being edited.
 #  #
 sub ApplyEdit {  sub ApplyEdit {
     my $directive   = shift;  
     my $editor      = shift;      my ($directive, $editor) = @_;
   
     # Break the directive down into its command and its parameters      # Break the directive down into its command and its parameters
     # (at most two at this point.  The meaning of the parameters, if in fact      # (at most two at this point.  The meaning of the parameters, if in fact
Line 649  sub AdjustOurHost { Line 863  sub AdjustOurHost {
 #        editor     - Editor containing the file.  #        editor     - Editor containing the file.
 #  #
 sub ReplaceConfigFile {  sub ReplaceConfigFile {
     my $filename  = shift;      
     my $editor    = shift;      my ($filename, $editor) = @_;
   
     CopyFile ($filename, $filename.".old");      CopyFile ($filename, $filename.".old");
   
Line 719  sub EditFile { Line 933  sub EditFile {
   
     return "ok\n";      return "ok\n";
 }  }
   
   #---------------------------------------------------------------
   #
   # Manipulation of hash based databases (factoring out common code
   # for later use as we refactor.
   #
   #  Ties a domain level resource file to a hash.
   #  If requested a history entry is created in the associated hist file.
   #
   #  Parameters:
   #     domain    - Name of the domain in which the resource file lives.
   #     namespace - Name of the hash within that domain.
   #     how       - How to tie the hash (e.g. GDBM_WRCREAT()).
   #     loghead   - Optional parameter, if present a log entry is created
   #                 in the associated history file and this is the first part
   #                  of that entry.
   #     logtail   - Goes along with loghead,  The actual logentry is of the
   #                 form $loghead:<timestamp>:logtail.
   # Returns:
   #    Reference to a hash bound to the db file or alternatively undef
   #    if the tie failed.
   #
   sub tie_domain_hash {
       my ($domain,$namespace,$how,$loghead,$logtail) = @_;
       
       # Filter out any whitespace in the domain name:
       
       $domain =~ s/\W//g;
       
       # We have enough to go on to tie the hash:
       
       my $user_top_dir   = $perlvar{'lonUsersDir'};
       my $domain_dir     = $user_top_dir."/$domain";
       my $resource_file  = $domain_dir."/$namespace.db";
       my %hash;
       if(tie(%hash, 'GDBM_File', $resource_file, $how, 0640)) {
    if (defined($loghead)) { # Need to log the operation.
       my $logFh = IO::File->new(">>$domain_dir/$namespace.hist");
       if($logFh) {
    my $timestamp = time;
    print $logFh "$loghead:$timestamp:$logtail\n";
       }
       $logFh->close;
    }
    return \%hash; # Return the tied hash.
       } else {
    return undef; # Tie failed.
       }
   }
   
   #
   #   Ties a user's resource file to a hash.  
   #   If necessary, an appropriate history
   #   log file entry is made as well.
   #   This sub factors out common code from the subs that manipulate
   #   the various gdbm files that keep keyword value pairs.
   # Parameters:
   #   domain       - Name of the domain the user is in.
   #   user         - Name of the 'current user'.
   #   namespace    - Namespace representing the file to tie.
   #   how          - What the tie is done to (e.g. GDBM_WRCREAT().
   #   loghead      - Optional first part of log entry if there may be a
   #                  history file.
   #   what         - Optional tail of log entry if there may be a history
   #                  file.
   # Returns:
   #   hash to which the database is tied.  It's up to the caller to untie.
   #   undef if the has could not be tied.
   #
   sub tie_user_hash {
       my ($domain,$user,$namespace,$how,$loghead,$what) = @_;
   
       $namespace=~s/\//\_/g; # / -> _
       $namespace=~s/\W//g; # whitespace eliminated.
       my $proname     = propath($domain, $user);
      
       #  Tie the database.
       
       my %hash;
       if(tie(%hash, 'GDBM_File', "$proname/$namespace.db",
      $how, 0640)) {
    # If this is a namespace for which a history is kept,
    # make the history log entry:    
    if (($namespace =~/^nohist\_/) && (defined($loghead))) {
       my $args = scalar @_;
       Debug(" Opening history: $namespace $args");
       my $hfh = IO::File->new(">>$proname/$namespace.hist"); 
       if($hfh) {
    my $now = time;
    print $hfh "$loghead:$now:$what\n";
       }
       $hfh->close;
    }
    return \%hash;
       } else {
    return undef;
       }
       
   }
   
   #--------------------- Request Handlers --------------------------------------------
   #
   #   By convention each request handler registers itself prior to the sub declaration:
   #
   
   #  Handles ping requests.
   #  Parameters:
   #      $cmd    - the actual keyword that invoked us.
   #      $tail   - the tail of the request that invoked us.
   #      $replyfd- File descriptor connected to the client
   #  Implicit Inputs:
   #      $currenthostid - Global variable that carries the name of the host we are
   #                       known as.
   #  Returns:
   #      1       - Ok to continue processing.
   #      0       - Program should exit.
   #  Side effects:
   #      Reply information is sent to the client.
   
   sub ping_handler {
       my ($cmd, $tail, $client) = @_;
       Debug("$cmd $tail $client .. $currenthostid:");
      
       Reply( $client,"$currenthostid\n","$cmd:$tail");
      
       return 1;
   }
   &register_handler("ping", \&ping_handler, 0, 1, 1);       # Ping unencoded, client or manager.
   
   
   #---------------------------------------------------------------
   #
   #   Getting, decoding and dispatching requests:
   #
   
   #
   #   Get a Request:
   #   Gets a Request message from the client.  The transaction
   #   is defined as a 'line' of text.  We remove the new line
   #   from the text line.  
   #   
   sub get_request {
       my $input = <$client>;
       chomp($input);
   
       Debug("get_request: Request = $input\n");
   
       &status('Processing '.$clientname.':'.$input);
   
       return $input;
   }
   #---------------------------------------------------------------
   #
   #  Process a request.  This sub should shrink as each action
   #  gets farmed out into a separat sub that is registered 
   #  with the dispatch hash.  
   #
   # Parameters:
   #    user_input   - The request received from the client (lonc).
   # Returns:
   #    true to keep processing, false if caller should exit.
   #
   sub process_request {
       my ($userinput) = @_;      # Easier for now to break style than to
                                   # fix all the userinput -> user_input.
       my $wasenc    = 0; # True if request was encrypted.
   # ------------------------------------------------------------ See if encrypted
       if ($userinput =~ /^enc/) {
    $userinput = decipher($userinput);
    $wasenc=1;
    if(!$userinput) { # Cipher not defined.
       &Failure($client, "error: Encrypted data without negotated key");
       return 0;
    }
       }
       Debug("process_request: $userinput\n");
       
       #  
       #   The 'correct way' to add a command to lond is now to
       #   write a sub to execute it and Add it to the command dispatch
       #   hash via a call to register_handler..  The comments to that
       #   sub should give you enough to go on to show how to do this
       #   along with the examples that are building up as this code
       #   is getting refactored.   Until all branches of the
       #   if/elseif monster below have been factored out into
       #   separate procesor subs, if the dispatch hash is missing
       #   the command keyword, we will fall through to the remainder
       #   of the if/else chain below in order to keep this thing in 
       #   working order throughout the transmogrification.
   
       my ($command, $tail) = split(/:/, $userinput, 2);
       chomp($command);
       chomp($tail);
       $tail =~ s/(\r)//; # This helps people debugging with e.g. telnet.
       $command =~ s/(\r)//; # And this too for parameterless commands.
       if(!$tail) {
    $tail =""; # defined but blank.
       }
   
       &Debug("Command received: $command, encoded = $wasenc");
   
       if(defined $Dispatcher{$command}) {
   
    my $dispatch_info = $Dispatcher{$command};
    my $handler       = $$dispatch_info[0];
    my $need_encode   = $$dispatch_info[1];
    my $client_types  = $$dispatch_info[2];
    Debug("Matched dispatch hash: mustencode: $need_encode "
         ."ClientType $client_types");
         
    #  Validate the request:
         
    my $ok = 1;
    my $requesterprivs = 0;
    if(&isClient()) {
       $requesterprivs |= $CLIENT_OK;
    }
    if(&isManager()) {
       $requesterprivs |= $MANAGER_OK;
    }
    if($need_encode && (!$wasenc)) {
       Debug("Must encode but wasn't: $need_encode $wasenc");
       $ok = 0;
    }
    if(($client_types & $requesterprivs) == 0) {
       Debug("Client not privileged to do this operation");
       $ok = 0;
    }
   
    if($ok) {
       Debug("Dispatching to handler $command $tail");
       my $keep_going = &$handler($command, $tail, $client);
       return $keep_going;
    } else {
       Debug("Refusing to dispatch because client did not match requirements");
       Failure($client, "refused\n", $userinput);
       return 1;
    }
   
       }    
   
   # ------------------------------------------------------------- Normal commands
       if ($userinput =~ /^pong/) { # client only
    if(isClient) {
       my $reply=&reply("ping",$clientname);
       print $client "$currenthostid:$reply\n"; 
    } else {
       Reply($client, "refused\n", $userinput);
    }
   # ------------------------------------------------------------------------ ekey
       } elsif ($userinput =~ /^ekey/) { # ok for both clients & mgrs
    my $buildkey=time.$$.int(rand 100000);
    $buildkey=~tr/1-6/A-F/;
    $buildkey=int(rand 100000).$buildkey.int(rand 100000);
    my $key=$currenthostid.$clientname;
    $key=~tr/a-z/A-Z/;
    $key=~tr/G-P/0-9/;
    $key=~tr/Q-Z/0-9/;
    $key=$key.$buildkey.$key.$buildkey.$key.$buildkey;
    $key=substr($key,0,32);
    my $cipherkey=pack("H32",$key);
    $cipher=new IDEA $cipherkey;
    print $client "$buildkey\n"; 
   # ------------------------------------------------------------------------ load
       } elsif ($userinput =~ /^load/) { # client only
    if (isClient) {
       my $loadavg;
       {
    my $loadfile=IO::File->new('/proc/loadavg');
    $loadavg=<$loadfile>;
       }
       $loadavg =~ s/\s.*//g;
       my $loadpercent=100*$loadavg/$perlvar{'lonLoadLim'};
       print $client "$loadpercent\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------------------------------------- userload
       } elsif ($userinput =~ /^userload/) { # client only
    if(isClient) {
       my $userloadpercent=&userload();
       print $client "$userloadpercent\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   #
   #        Transactions requiring encryption:
   #
   # ----------------------------------------------------------------- currentauth
       } elsif ($userinput =~ /^currentauth/) {
    if (($wasenc==1)  && isClient) { # Encoded & client only.
       my ($cmd,$udom,$uname)=split(/:/,$userinput);
       my $result = GetAuthType($udom, $uname);
       if($result eq "nouser") {
    print $client "unknown_user\n";
       }
       else {
    print $client "$result\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   #--------------------------------------------------------------------- pushfile
       } elsif($userinput =~ /^pushfile/) { # encoded & manager.
    if(($wasenc == 1) && isManager) {
       my $cert = GetCertificate($userinput);
       if(ValidManager($cert)) {
    my $reply = PushFile($userinput);
    print $client "$reply\n";
       } else {
    print $client "refused\n";
       } 
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   #--------------------------------------------------------------------- reinit
       } elsif($userinput =~ /^reinit/) { # Encoded and manager
    if (($wasenc == 1) && isManager) {
       my $cert = GetCertificate($userinput);
       if(ValidManager($cert)) {
    chomp($userinput);
    my $reply = ReinitProcess($userinput);
    print $client  "$reply\n";
       } else {
    print $client "refused\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
    }
   #------------------------------------------------------------------------- edit
       } elsif ($userinput =~ /^edit/) {    # encoded and manager:
    if(($wasenc ==1) && (isManager)) {
       my $cert = GetCertificate($userinput);
       if(ValidManager($cert)) {
    my($command, $filetype, $script) = split(/:/, $userinput);
    if (($filetype eq "hosts") || ($filetype eq "domain")) {
       if($script ne "") {
    Reply($client, EditFile($userinput));
       } else {
    Reply($client,"refused\n",$userinput);
       }
    } else {
       Reply($client,"refused\n",$userinput);
    }
               } else {
    Reply($client,"refused\n",$userinput);
               }
    } else {
       Reply($client,"refused\n",$userinput);
    }
   # ------------------------------------------------------------------------ auth
       } elsif ($userinput =~ /^auth/) { # Encoded and client only.
    if (($wasenc==1) && isClient) {
       my ($cmd,$udom,$uname,$upass)=split(/:/,$userinput);
       chomp($upass);
       $upass=unescape($upass);
       my $proname=propath($udom,$uname);
       my $passfilename="$proname/passwd";
       if (-e $passfilename) {
    my $pf = IO::File->new($passfilename);
    my $realpasswd=<$pf>;
    chomp($realpasswd);
    my ($howpwd,$contentpwd)=split(/:/,$realpasswd);
    my $pwdcorrect=0;
    if ($howpwd eq 'internal') {
       &Debug("Internal auth");
       $pwdcorrect=
    (crypt($upass,$contentpwd) eq $contentpwd);
    } elsif ($howpwd eq 'unix') {
       &Debug("Unix auth");
       if((getpwnam($uname))[1] eq "") { #no such user!
    $pwdcorrect = 0;
       } else {
    $contentpwd=(getpwnam($uname))[1];
    my $pwauth_path="/usr/local/sbin/pwauth";
    unless ($contentpwd eq 'x') {
       $pwdcorrect=
    (crypt($upass,$contentpwd) eq 
    $contentpwd);
    }
   
    elsif (-e $pwauth_path) {
       open PWAUTH, "|$pwauth_path" or
    die "Cannot invoke authentication";
       print PWAUTH "$uname\n$upass\n";
       close PWAUTH;
       $pwdcorrect=!$?;
    }
       }
    } elsif ($howpwd eq 'krb4') {
       my $null=pack("C",0);
       unless ($upass=~/$null/) {
    my $krb4_error = &Authen::Krb4::get_pw_in_tkt
       ($uname,"",$contentpwd,'krbtgt',
        $contentpwd,1,$upass);
    if (!$krb4_error) {
       $pwdcorrect = 1;
    } else { 
       $pwdcorrect=0; 
       # log error if it is not a bad password
       if ($krb4_error != 62) {
    &logthis('krb4:'.$uname.','.
    &Authen::Krb4::get_err_txt($Authen::Krb4::error));
       }
    }
       }
    } elsif ($howpwd eq 'krb5') {
       my $null=pack("C",0);
       unless ($upass=~/$null/) {
    my $krbclient=&Authen::Krb5::parse_name($uname.'@'.$contentpwd);
    my $krbservice="krbtgt/".$contentpwd."\@".$contentpwd;
    my $krbserver=&Authen::Krb5::parse_name($krbservice);
    my $credentials=&Authen::Krb5::cc_default();
    $credentials->initialize($krbclient);
    my $krbreturn = 
       &Authen::Krb5::get_in_tkt_with_password(
       $krbclient,$krbserver,$upass,$credentials);
   #  unless ($krbreturn) {
   #      &logthis("Krb5 Error: ".
   #       &Authen::Krb5::error());
   #  }
    $pwdcorrect = ($krbreturn == 1);
       } else { $pwdcorrect=0; }
    } elsif ($howpwd eq 'localauth') {
       $pwdcorrect=&localauth::localauth($uname,$upass,
         $contentpwd);
    }
    if ($pwdcorrect) {
       print $client "authorized\n";
    } else {
       print $client "non_authorized\n";
    }  
       } else {
    print $client "unknown_user\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ---------------------------------------------------------------------- passwd
       } elsif ($userinput =~ /^passwd/) { # encoded and client
    if (($wasenc==1) && isClient) {
       my 
    ($cmd,$udom,$uname,$upass,$npass)=split(/:/,$userinput);
       chomp($npass);
       $upass=&unescape($upass);
       $npass=&unescape($npass);
       &Debug("Trying to change password for $uname");
       my $proname=propath($udom,$uname);
       my $passfilename="$proname/passwd";
       if (-e $passfilename) {
    my $realpasswd;
    { my $pf = IO::File->new($passfilename);
     $realpasswd=<$pf>; }
    chomp($realpasswd);
    my ($howpwd,$contentpwd)=split(/:/,$realpasswd);
    if ($howpwd eq 'internal') {
       &Debug("internal auth");
       if (crypt($upass,$contentpwd) eq $contentpwd) {
    my $salt=time;
    $salt=substr($salt,6,2);
    my $ncpass=crypt($npass,$salt);
    {
       my $pf;
       if ($pf = IO::File->new(">$passfilename")) {
    print $pf "internal:$ncpass\n";
    &logthis("Result of password change for $uname: pwchange_success");
    print $client "ok\n";
       } else {
    &logthis("Unable to open $uname passwd to change password");
    print $client "non_authorized\n";
       }
    }             
   
       } else {
    print $client "non_authorized\n";
       }
    } elsif ($howpwd eq 'unix') {
       # Unix means we have to access /etc/password
       # one way or another.
       # First: Make sure the current password is
       #        correct
       &Debug("auth is unix");
       $contentpwd=(getpwnam($uname))[1];
       my $pwdcorrect = "0";
       my $pwauth_path="/usr/local/sbin/pwauth";
       unless ($contentpwd eq 'x') {
    $pwdcorrect=
       (crypt($upass,$contentpwd) eq $contentpwd);
       } elsif (-e $pwauth_path) {
    open PWAUTH, "|$pwauth_path" or
       die "Cannot invoke authentication";
    print PWAUTH "$uname\n$upass\n";
    close PWAUTH;
    &Debug("exited pwauth with $? ($uname,$upass) ");
    $pwdcorrect=($? == 0);
       }
       if ($pwdcorrect) {
    my $execdir=$perlvar{'lonDaemons'};
    &Debug("Opening lcpasswd pipeline");
    my $pf = IO::File->new("|$execdir/lcpasswd > $perlvar{'lonDaemons'}/logs/lcpasswd.log");
    print $pf "$uname\n$npass\n$npass\n";
    close $pf;
    my $err = $?;
    my $result = ($err>0 ? 'pwchange_failure' 
         : 'ok');
    &logthis("Result of password change for $uname: ".
    &lcpasswdstrerror($?));
    print $client "$result\n";
       } else {
    print $client "non_authorized\n";
       }
    } else {
       print $client "auth_mode_error\n";
    }  
       } else {
    print $client "unknown_user\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------------------------------------- makeuser
       } elsif ($userinput =~ /^makeuser/) { # encoded and client.
    &Debug("Make user received");
    my $oldumask=umask(0077);
    if (($wasenc==1) && isClient) {
       my 
    ($cmd,$udom,$uname,$umode,$npass)=split(/:/,$userinput);
       &Debug("cmd =".$cmd." $udom =".$udom.
      " uname=".$uname);
       chomp($npass);
       $npass=&unescape($npass);
       my $proname=propath($udom,$uname);
       my $passfilename="$proname/passwd";
       &Debug("Password file created will be:".
      $passfilename);
       if (-e $passfilename) {
    print $client "already_exists\n";
       } elsif ($udom ne $currentdomainid) {
    print $client "not_right_domain\n";
       } else {
    my @fpparts=split(/\//,$proname);
    my $fpnow=$fpparts[0].'/'.$fpparts[1].'/'.$fpparts[2];
    my $fperror='';
    for (my $i=3;$i<=$#fpparts;$i++) {
       $fpnow.='/'.$fpparts[$i]; 
       unless (-e $fpnow) {
    unless (mkdir($fpnow,0777)) {
       $fperror="error: ".($!+0)
    ." mkdir failed while attempting "
    ."makeuser";
    }
       }
    }
    unless ($fperror) {
       my $result=&make_passwd_file($uname, $umode,$npass,
    $passfilename);
       print $client $result;
    } else {
       print $client "$fperror\n";
    }
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
    umask($oldumask);
   # -------------------------------------------------------------- changeuserauth
       } elsif ($userinput =~ /^changeuserauth/) { # encoded & client
    &Debug("Changing authorization");
    if (($wasenc==1) && isClient) {
       my 
    ($cmd,$udom,$uname,$umode,$npass)=split(/:/,$userinput);
       chomp($npass);
       &Debug("cmd = ".$cmd." domain= ".$udom.
      "uname =".$uname." umode= ".$umode);
       $npass=&unescape($npass);
       my $proname=&propath($udom,$uname);
       my $passfilename="$proname/passwd";
       if ($udom ne $currentdomainid) {
    print $client "not_right_domain\n";
       } else {
    my $result=&make_passwd_file($uname, $umode,$npass,
        $passfilename);
    print $client $result;
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------ home
       } elsif ($userinput =~ /^home/) { # client clear or encoded
    if(isClient) {
       my ($cmd,$udom,$uname)=split(/:/,$userinput);
       chomp($uname);
       my $proname=propath($udom,$uname);
       if (-e $proname) {
    print $client "found\n";
       } else {
    print $client "not_found\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ---------------------------------------------------------------------- update
       } elsif ($userinput =~ /^update/) { # client clear or encoded.
    if(isClient) {
       my ($cmd,$fname)=split(/:/,$userinput);
       my $ownership=ishome($fname);
       if ($ownership eq 'not_owner') {
    if (-e $fname) {
       my ($dev,$ino,$mode,$nlink,
    $uid,$gid,$rdev,$size,
    $atime,$mtime,$ctime,
    $blksize,$blocks)=stat($fname);
       my $now=time;
       my $since=$now-$atime;
       if ($since>$perlvar{'lonExpire'}) {
    my $reply=
       &reply("unsub:$fname","$clientname");
       unlink("$fname");
       } else {
    my $transname="$fname.in.transfer";
    my $remoteurl=
       &reply("sub:$fname","$clientname");
    my $response;
    {
       my $ua=new LWP::UserAgent;
       my $request=new HTTP::Request('GET',"$remoteurl");
       $response=$ua->request($request,$transname);
    }
    if ($response->is_error()) {
       unlink($transname);
       my $message=$response->status_line;
       &logthis(
        "LWP GET: $message for $fname ($remoteurl)");
    } else {
       if ($remoteurl!~/\.meta$/) {
    my $ua=new LWP::UserAgent;
    my $mrequest=
       new HTTP::Request('GET',$remoteurl.'.meta');
    my $mresponse=
       $ua->request($mrequest,$fname.'.meta');
    if ($mresponse->is_error()) {
       unlink($fname.'.meta');
    }
       }
       rename($transname,$fname);
    }
       }
       print $client "ok\n";
    } else {
       print $client "not_found\n";
    }
       } else {
    print $client "rejected\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------- fetch a user file from a remote server
       } elsif ($userinput =~ /^fetchuserfile/) { # Client clear or enc.
    if(isClient) {
       my ($cmd,$fname)=split(/:/,$userinput);
       my ($udom,$uname,$ufile) = ($fname =~ m|^([^/]+)/([^/]+)/(.+)$|);
       my $udir=propath($udom,$uname).'/userfiles';
       unless (-e $udir) { mkdir($udir,0770); }
       if (-e $udir) {
    $ufile=~s/^[\.\~]+//;
    my $path = $udir;
    if ($ufile =~m|(.+)/([^/]+)$|) {
       my @parts=split('/',$1);
       foreach my $part (@parts) {
    $path .= '/'.$part;
    if ((-e $path)!=1) {
       mkdir($path,0770);
    }
       }
    }
    my $destname=$udir.'/'.$ufile;
    my $transname=$udir.'/'.$ufile.'.in.transit';
    my $remoteurl='http://'.$clientip.'/userfiles/'.$fname;
    my $response;
    {
       my $ua=new LWP::UserAgent;
       my $request=new HTTP::Request('GET',"$remoteurl");
       $response=$ua->request($request,$transname);
    }
    if ($response->is_error()) {
       unlink($transname);
       my $message=$response->status_line;
       &logthis("LWP GET: $message for $fname ($remoteurl)");
       print $client "failed\n";
    } else {
       if (!rename($transname,$destname)) {
    &logthis("Unable to move $transname to $destname");
    unlink($transname);
    print $client "failed\n";
       } else {
    print $client "ok\n";
       }
    }
       } else {
    print $client "not_home\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
    }
   # --------------------------------------------------------- remove a user file 
       } elsif ($userinput =~ /^removeuserfile/) { # Client clear or enc.
    if(isClient) {
       my ($cmd,$fname)=split(/:/,$userinput);
       my ($udom,$uname,$ufile) = ($fname =~ m|^([^/]+)/([^/]+)/(.+)$|);
       &logthis("$udom - $uname - $ufile");
       if ($ufile =~m|/\.\./|) {
    # any files paths with /../ in them refuse 
    # to deal with
    print $client "refused\n";
       } else {
    my $udir=propath($udom,$uname);
    if (-e $udir) {
       my $file=$udir.'/userfiles/'.$ufile;
       if (-e $file) {
    unlink($file);
    if (-e $file) {
       print $client "failed\n";
    } else {
       print $client "ok\n";
    }
       } else {
    print $client "not_found\n";
       }
    } else {
       print $client "not_home\n";
    }
       }
    } else {
       Reply($client, "refused\n", $userinput);
    }
   # ------------------------------------------ authenticate access to a user file
       } elsif ($userinput =~ /^tokenauthuserfile/) { # Client only
    if(isClient) {
       my ($cmd,$fname,$session)=split(/:/,$userinput);
       chomp($session);
       my $reply='non_auth';
       if (open(ENVIN,$perlvar{'lonIDsDir'}.'/'.
        $session.'.id')) {
    while (my $line=<ENVIN>) {
       if ($line=~ m|userfile\.\Q$fname\E\=|) { $reply='ok'; }
       }
    close(ENVIN);
    print $client $reply."\n";
       } else {
    print $client "invalid_token\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------- unsubscribe
       } elsif ($userinput =~ /^unsub/) {
    if(isClient) {
       my ($cmd,$fname)=split(/:/,$userinput);
       if (-e $fname) {
    print $client &unsub($fname,$clientip);
       } else {
    print $client "not_found\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------- subscribe
       } elsif ($userinput =~ /^sub/) {
    if(isClient) {
       print $client &subscribe($userinput,$clientip);
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------- current version
       } elsif ($userinput =~ /^currentversion/) {
    if(isClient) {
       my ($cmd,$fname)=split(/:/,$userinput);
       print $client &currentversion($fname)."\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------- log
       } elsif ($userinput =~ /^log/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$what)=split(/:/,$userinput);
       chomp($what);
       my $proname=propath($udom,$uname);
       my $now=time;
       {
    my $hfh;
    if ($hfh=IO::File->new(">>$proname/activity.log")) { 
       print $hfh "$now:$clientname:$what\n";
       print $client "ok\n"; 
    } else {
       print $client "error: ".($!+0)
    ." IO::File->new Failed "
    ."while attempting log\n";
    }
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------- put
       } elsif ($userinput =~ /^put/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$what)
    =split(/:/,$userinput,5);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       if ($namespace ne 'roles') {
    chomp($what);
    my $proname=propath($udom,$uname);
    my $now=time;
    my @pairs=split(/\&/,$what);
    my %hash;
    if (tie(%hash,'GDBM_File',
    "$proname/$namespace.db",
    &GDBM_WRCREAT(),0640)) {
       unless ($namespace=~/^nohist\_/) {
    my $hfh;
    if ($hfh=IO::File->new(">>$proname/$namespace.hist")) { print $hfh "P:$now:$what\n"; }
       }
       
       foreach my $pair (@pairs) {
    my ($key,$value)=split(/=/,$pair);
    $hash{$key}=$value;
       }
       if (untie(%hash)) {
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)
       ." untie(GDBM) failed ".
       "while attempting put\n";
       }
    } else {
       print $client "error: ".($!)
    ." tie(GDBM) Failed ".
    "while attempting put\n";
    }
       } else {
    print $client "refused\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------- inc
       } elsif ($userinput =~ /^inc:/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$what)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       if ($namespace ne 'roles') {
    chomp($what);
    my $proname=propath($udom,$uname);
    my $now=time;
    my @pairs=split(/\&/,$what);
    my %hash;
    if (tie(%hash,'GDBM_File',
    "$proname/$namespace.db",
    &GDBM_WRCREAT(),0640)) {
       unless ($namespace=~/^nohist\_/) {
    my $hfh;
    if ($hfh=IO::File->new(">>$proname/$namespace.hist")) { print $hfh "P:$now:$what\n"; }
       }
       foreach my $pair (@pairs) {
    my ($key,$value)=split(/=/,$pair);
    # We could check that we have a number...
    if (! defined($value) || $value eq '') {
       $value = 1;
    }
    $hash{$key}+=$value;
       }
       if (untie(%hash)) {
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)
       ." untie(GDBM) failed ".
       "while attempting inc\n";
       }
    } else {
       print $client "error: ".($!)
    ." tie(GDBM) Failed ".
    "while attempting inc\n";
    }
       } else {
    print $client "refused\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------------------------------------- rolesput
       } elsif ($userinput =~ /^rolesput/) {
    if(isClient) {
       &Debug("rolesput");
       if ($wasenc==1) {
    my ($cmd,$exedom,$exeuser,$udom,$uname,$what)
       =split(/:/,$userinput);
    &Debug("cmd = ".$cmd." exedom= ".$exedom.
          "user = ".$exeuser." udom=".$udom.
          "what = ".$what);
    my $namespace='roles';
    chomp($what);
    my $proname=propath($udom,$uname);
    my $now=time;
    my @pairs=split(/\&/,$what);
    my %hash;
    if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {
       {
    my $hfh;
    if ($hfh=IO::File->new(">>$proname/$namespace.hist")) { 
       print $hfh "P:$now:$exedom:$exeuser:$what\n";
    }
       }
       
       foreach my $pair (@pairs) {
    my ($key,$value)=split(/=/,$pair);
    &ManagePermissions($key, $udom, $uname,
      &GetAuthType( $udom, 
    $uname));
    $hash{$key}=$value;
       }
       if (untie(%hash)) {
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)
       ." untie(GDBM) Failed ".
       "while attempting rolesput\n";
       }
    } else {
       print $client "error: ".($!+0)
    ." tie(GDBM) Failed ".
    "while attempting rolesput\n";
       }
       } else {
    print $client "refused\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------------------------------------- rolesdel
       } elsif ($userinput =~ /^rolesdel/) {
    if(isClient) {
       &Debug("rolesdel");
       if ($wasenc==1) {
    my ($cmd,$exedom,$exeuser,$udom,$uname,$what)
       =split(/:/,$userinput);
    &Debug("cmd = ".$cmd." exedom= ".$exedom.
          "user = ".$exeuser." udom=".$udom.
          "what = ".$what);
    my $namespace='roles';
    chomp($what);
    my $proname=propath($udom,$uname);
    my $now=time;
    my @rolekeys=split(/\&/,$what);
    my %hash;
    if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {
       {
    my $hfh;
    if ($hfh=IO::File->new(">>$proname/$namespace.hist")) { 
       print $hfh "D:$now:$exedom:$exeuser:$what\n";
    }
       }
       foreach my $key (@rolekeys) {
    delete $hash{$key};
       }
       if (untie(%hash)) {
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)
       ." untie(GDBM) Failed ".
       "while attempting rolesdel\n";
       }
    } else {
       print $client "error: ".($!+0)
    ." tie(GDBM) Failed ".
    "while attempting rolesdel\n";
    }
       } else {
    print $client "refused\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------- get
       } elsif ($userinput =~ /^get/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$what)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       chomp($what);
       my @queries=split(/\&/,$what);
       my $proname=propath($udom,$uname);
       my $qresult='';
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {
    for (my $i=0;$i<=$#queries;$i++) {
       $qresult.="$hash{$queries[$i]}&";
    }
    if (untie(%hash)) {
       $qresult=~s/\&$//;
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting get\n";
    }
       } else {
    if ($!+0 == 2) {
       print $client "error:No such file or ".
    "GDBM reported bad block error\n";
    } else {
       print $client "error: ".($!+0)
    ." tie(GDBM) Failed ".
    "while attempting get\n";
    }
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------ eget
       } elsif ($userinput =~ /^eget/) {
    if (isClient) {
       my ($cmd,$udom,$uname,$namespace,$what)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       chomp($what);
       my @queries=split(/\&/,$what);
       my $proname=propath($udom,$uname);
       my $qresult='';
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {
    for (my $i=0;$i<=$#queries;$i++) {
       $qresult.="$hash{$queries[$i]}&";
    }
    if (untie(%hash)) {
       $qresult=~s/\&$//;
       if ($cipher) {
    my $cmdlength=length($qresult);
    $qresult.="         ";
    my $encqresult='';
    for 
       (my $encidx=0;$encidx<=$cmdlength;$encidx+=8) {
    $encqresult.=
       unpack("H16",
      $cipher->encrypt(substr($qresult,$encidx,8)));
       }
    print $client "enc:$cmdlength:$encqresult\n";
       } else {
    print $client "error:no_key\n";
       }
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting eget\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting eget\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------- del
       } elsif ($userinput =~ /^del/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$what)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       chomp($what);
       my $proname=propath($udom,$uname);
       my $now=time;
       my @keys=split(/\&/,$what);
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {
    unless ($namespace=~/^nohist\_/) {
       my $hfh;
       if ($hfh=IO::File->new(">>$proname/$namespace.hist")) { print $hfh "D:$now:$what\n"; }
    }
    foreach my $key (@keys) {
       delete($hash{$key});
    }
    if (untie(%hash)) {
       print $client "ok\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting del\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting del\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------------ keys
       } elsif ($userinput =~ /^keys/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       my $proname=propath($udom,$uname);
       my $qresult='';
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {
    foreach my $key (keys %hash) {
       $qresult.="$key&";
    }
    if (untie(%hash)) {
       $qresult=~s/\&$//;
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting keys\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting keys\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------- dumpcurrent
       } elsif ($userinput =~ /^currentdump/) {
    if (isClient) {
       my ($cmd,$udom,$uname,$namespace)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       my $qresult='';
       my $proname=propath($udom,$uname);
       my %hash;
       if (tie(%hash,'GDBM_File',
       "$proname/$namespace.db",
       &GDBM_READER(),0640)) {
       # Structure of %data:
    # $data{$symb}->{$parameter}=$value;
    # $data{$symb}->{'v.'.$parameter}=$version;
    # since $parameter will be unescaped, we do not
    # have to worry about silly parameter names...
    my %data = ();
    while (my ($key,$value) = each(%hash)) {
       my ($v,$symb,$param) = split(/:/,$key);
       next if ($v eq 'version' || $symb eq 'keys');
       next if (exists($data{$symb}) && 
        exists($data{$symb}->{$param}) &&
        $data{$symb}->{'v.'.$param} > $v);
       $data{$symb}->{$param}=$value;
       $data{$symb}->{'v.'.$param}=$v;
    }
    if (untie(%hash)) {
       while (my ($symb,$param_hash) = each(%data)) {
    while(my ($param,$value) = each (%$param_hash)){
       next if ($param =~ /^v\./);
       $qresult.=$symb.':'.$param.'='.$value.'&';
    }
       }
       chop($qresult);
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting currentdump\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting currentdump\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
    }
   # ------------------------------------------------------------------------ dump
       } elsif ($userinput =~ /^dump/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$regexp)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       if (defined($regexp)) {
    $regexp=&unescape($regexp);
       } else {
    $regexp='.';
       }
       my $qresult='';
       my $proname=propath($udom,$uname);
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {
    while (my ($key,$value) = each(%hash)) {
       if ($regexp eq '.') {
    $qresult.=$key.'='.$value.'&';
       } else {
    my $unescapeKey = &unescape($key);
    if (eval('$unescapeKey=~/$regexp/')) {
       $qresult.="$key=$value&";
    }
       }
    }
    if (untie(%hash)) {
       chop($qresult);
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting dump\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting dump\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------------- store
       } elsif ($userinput =~ /^store/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$rid,$what)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       if ($namespace ne 'roles') {
    chomp($what);
    my $proname=propath($udom,$uname);
    my $now=time;
    my @pairs=split(/\&/,$what);
    my %hash;
    if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {
       unless ($namespace=~/^nohist\_/) {
    my $hfh;
    if ($hfh=IO::File->new(">>$proname/$namespace.hist")) {
       print $hfh "P:$now:$rid:$what\n";
    }
       }
       my @previouskeys=split(/&/,$hash{"keys:$rid"});
       my $key;
       $hash{"version:$rid"}++;
       my $version=$hash{"version:$rid"};
       my $allkeys=''; 
       foreach my $pair (@pairs) {
    my ($key,$value)=split(/=/,$pair);
    $allkeys.=$key.':';
    $hash{"$version:$rid:$key"}=$value;
       }
       $hash{"$version:$rid:timestamp"}=$now;
       $allkeys.='timestamp';
       $hash{"$version:keys:$rid"}=$allkeys;
       if (untie(%hash)) {
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)
       ." untie(GDBM) Failed ".
       "while attempting store\n";
    }
    } else {
       print $client "error: ".($!+0)
    ." tie(GDBM) Failed ".
    "while attempting store\n";
    }
       } else {
    print $client "refused\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # --------------------------------------------------------------------- restore
       } elsif ($userinput =~ /^restore/) {
    if(isClient) {
       my ($cmd,$udom,$uname,$namespace,$rid)
    =split(/:/,$userinput);
       $namespace=~s/\//\_/g;
       $namespace=~s/\W//g;
       chomp($rid);
       my $proname=propath($udom,$uname);
       my $qresult='';
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {
    my $version=$hash{"version:$rid"};
    $qresult.="version=$version&";
    my $scope;
    for ($scope=1;$scope<=$version;$scope++) {
       my $vkeys=$hash{"$scope:keys:$rid"};
       my @keys=split(/:/,$vkeys);
       my $key;
       $qresult.="$scope:keys=$vkeys&";
       foreach $key (@keys) {
    $qresult.="$scope:$key=".$hash{"$scope:$rid:$key"}."&";
       }                                  
    }
    if (untie(%hash)) {
       $qresult=~s/\&$//;
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting restore\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting restore\n";
       }
    } else  {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------------------------------------- chatsend
       } elsif ($userinput =~ /^chatsend/) {
    if(isClient) {
       my ($cmd,$cdom,$cnum,$newpost)=split(/\:/,$userinput);
       &chatadd($cdom,$cnum,$newpost);
       print $client "ok\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # -------------------------------------------------------------------- chatretr
       } elsif ($userinput =~ /^chatretr/) {
    if(isClient) {
       my 
    ($cmd,$cdom,$cnum,$udom,$uname)=split(/\:/,$userinput);
       my $reply='';
       foreach (&getchat($cdom,$cnum,$udom,$uname)) {
    $reply.=&escape($_).':';
       }
       $reply=~s/\:$//;
       print $client $reply."\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------- querysend
       } elsif ($userinput =~ /^querysend/) {
    if (isClient) {
       my ($cmd,$query,
    $arg1,$arg2,$arg3)=split(/\:/,$userinput);
       $query=~s/\n*$//g;
       print $client "".
    sqlreply("$clientname\&$query".
    "\&$arg1"."\&$arg2"."\&$arg3")."\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------ queryreply
       } elsif ($userinput =~ /^queryreply/) {
    if(isClient) {
       my ($cmd,$id,$reply)=split(/:/,$userinput); 
       my $store;
       my $execdir=$perlvar{'lonDaemons'};
       if ($store=IO::File->new(">$execdir/tmp/$id")) {
    $reply=~s/\&/\n/g;
    print $store $reply;
    close $store;
    my $store2=IO::File->new(">$execdir/tmp/$id.end");
    print $store2 "done\n";
    close $store2;
    print $client "ok\n";
       }
       else {
    print $client "error: ".($!+0)
       ." IO::File->new Failed ".
       "while attempting queryreply\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------- courseidput
       } elsif ($userinput =~ /^courseidput/) {
    if(isClient) {
       my ($cmd,$udom,$what)=split(/:/,$userinput);
       chomp($what);
    $udom=~s/\W//g;
       my $proname=
    "$perlvar{'lonUsersDir'}/$udom/nohist_courseids";
       my $now=time;
       my @pairs=split(/\&/,$what);
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_WRCREAT(),0640)) {
    foreach my $pair (@pairs) {
       my ($key,$descr,$inst_code)=split(/=/,$pair);
       $hash{$key}=$descr.':'.$inst_code.':'.$now;
    }
    if (untie(%hash)) {
       print $client "ok\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting courseidput\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting courseidput\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ---------------------------------------------------------------- courseiddump
       } elsif ($userinput =~ /^courseiddump/) {
    if(isClient) {
       my ($cmd,$udom,$since,$description)
    =split(/:/,$userinput);
       if (defined($description)) {
    $description=&unescape($description);
       } else {
    $description='.';
       }
       unless (defined($since)) { $since=0; }
       my $qresult='';
       my $proname=
    "$perlvar{'lonUsersDir'}/$udom/nohist_courseids";
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_READER(),0640)) {
    while (my ($key,$value) = each(%hash)) {
       my ($descr,$lasttime,$inst_code);
       if ($value =~ m/^([^\:]*):([^\:]*):(\d+)$/) {
    ($descr,$inst_code,$lasttime)=($1,$2,$3);
       } else {
    ($descr,$lasttime) = split(/\:/,$value);
       }
       if ($lasttime<$since) { next; }
       if ($description eq '.') {
    $qresult.=$key.'='.$descr.':'.$inst_code.'&';
       } else {
    my $unescapeVal = &unescape($descr);
    if (eval('$unescapeVal=~/\Q$description\E/i')) {
       $qresult.=$key.'='.$descr.':'.$inst_code.'&';
    }
       }
    }
    if (untie(%hash)) {
       chop($qresult);
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting courseiddump\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting courseiddump\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------------- idput
       } elsif ($userinput =~ /^idput/) {
    if(isClient) {
       my ($cmd,$udom,$what)=split(/:/,$userinput);
       chomp($what);
       $udom=~s/\W//g;
       my $proname="$perlvar{'lonUsersDir'}/$udom/ids";
       my $now=time;
       my @pairs=split(/\&/,$what);
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_WRCREAT(),0640)) {
    {
       my $hfh;
       if ($hfh=IO::File->new(">>$proname.hist")) {
    print $hfh "P:$now:$what\n";
       }
    }
    foreach my $pair (@pairs) {
       my ($key,$value)=split(/=/,$pair);
       $hash{$key}=$value;
    }
    if (untie(%hash)) {
       print $client "ok\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting idput\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting idput\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------------- idget
       } elsif ($userinput =~ /^idget/) {
    if(isClient) {
       my ($cmd,$udom,$what)=split(/:/,$userinput);
       chomp($what);
       $udom=~s/\W//g;
       my $proname="$perlvar{'lonUsersDir'}/$udom/ids";
       my @queries=split(/\&/,$what);
       my $qresult='';
       my %hash;
       if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_READER(),0640)) {
    for (my $i=0;$i<=$#queries;$i++) {
       $qresult.="$hash{$queries[$i]}&";
    }
    if (untie(%hash)) {
       $qresult=~s/\&$//;
       print $client "$qresult\n";
    } else {
       print $client "error: ".($!+0)
    ." untie(GDBM) Failed ".
    "while attempting idget\n";
    }
       } else {
    print $client "error: ".($!+0)
       ." tie(GDBM) Failed ".
       "while attempting idget\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ---------------------------------------------------------------------- tmpput
       } elsif ($userinput =~ /^tmpput/) {
    if(isClient) {
       my ($cmd,$what)=split(/:/,$userinput);
       my $store;
       $tmpsnum++;
       my $id=$$.'_'.$clientip.'_'.$tmpsnum;
       $id=~s/\W/\_/g;
       $what=~s/\n//g;
       my $execdir=$perlvar{'lonDaemons'};
       if ($store=IO::File->new(">$execdir/tmp/$id.tmp")) {
    print $store $what;
    close $store;
    print $client "$id\n";
       }
       else {
    print $client "error: ".($!+0)
       ."IO::File->new Failed ".
       "while attempting tmpput\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   
   # ---------------------------------------------------------------------- tmpget
       } elsif ($userinput =~ /^tmpget/) {
    if(isClient) {
       my ($cmd,$id)=split(/:/,$userinput);
       chomp($id);
       $id=~s/\W/\_/g;
       my $store;
       my $execdir=$perlvar{'lonDaemons'};
       if ($store=IO::File->new("$execdir/tmp/$id.tmp")) {
    my $reply=<$store>;
       print $client "$reply\n";
    close $store;
       }
       else {
    print $client "error: ".($!+0)
       ."IO::File->new Failed ".
       "while attempting tmpget\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ---------------------------------------------------------------------- tmpdel
       } elsif ($userinput =~ /^tmpdel/) {
    if(isClient) {
       my ($cmd,$id)=split(/:/,$userinput);
       chomp($id);
       $id=~s/\W/\_/g;
       my $execdir=$perlvar{'lonDaemons'};
       if (unlink("$execdir/tmp/$id.tmp")) {
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)
       ."Unlink tmp Failed ".
       "while attempting tmpdel\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------- portfolio directory list (portls)
       } elsif ($userinput =~ /^portls/) {
    if(isClient) {
       my ($cmd,$uname,$udom)=split(/:/,$userinput);
       my $udir=propath($udom,$uname).'/userfiles/portfolio';
       my $dirLine='';
       my $dirContents='';
       if (opendir(LSDIR,$udir.'/')){
    while ($dirLine = readdir(LSDIR)){
       $dirContents = $dirContents.$dirLine.'<br />';
    }
       } else {
    $dirContents = "No directory found\n";
       }
       print $client $dirContents."\n";
    } else {
       Reply($client, "refused\n", $userinput);
    }
   # -------------------------------------------------------------------------- ls
       } elsif ($userinput =~ /^ls/) {
    if(isClient) {
       my $obs;
       my $rights;
       my ($cmd,$ulsdir)=split(/:/,$userinput);
       my $ulsout='';
       my $ulsfn;
       if (-e $ulsdir) {
    if(-d $ulsdir) {
       if (opendir(LSDIR,$ulsdir)) {
    while ($ulsfn=readdir(LSDIR)) {
       undef $obs, $rights; 
       my @ulsstats=stat($ulsdir.'/'.$ulsfn);
       #We do some obsolete checking here
       if(-e $ulsdir.'/'.$ulsfn.".meta") { 
    open(FILE, $ulsdir.'/'.$ulsfn.".meta");
    my @obsolete=<FILE>;
    foreach my $obsolete (@obsolete) {
       if($obsolete =~ m|(<obsolete>)(on)|) { $obs = 1; } 
       if($obsolete =~ m|(<copyright>)(default)|) { $rights = 1; }
    }
       }
       $ulsout.=$ulsfn.'&'.join('&',@ulsstats);
       if($obs eq '1') { $ulsout.="&1"; }
       else { $ulsout.="&0"; }
       if($rights eq '1') { $ulsout.="&1:"; }
       else { $ulsout.="&0:"; }
    }
    closedir(LSDIR);
       }
    } else {
       my @ulsstats=stat($ulsdir);
       $ulsout.=$ulsfn.'&'.join('&',@ulsstats).':';
    }
       } else {
    $ulsout='no_such_dir';
       }
       if ($ulsout eq '') { $ulsout='empty'; }
       print $client "$ulsout\n";
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ----------------------------------------------------------------- setannounce
       } elsif ($userinput =~ /^setannounce/) {
    if (isClient) {
       my ($cmd,$announcement)=split(/:/,$userinput);
       chomp($announcement);
       $announcement=&unescape($announcement);
       if (my $store=IO::File->new('>'.$perlvar{'lonDocRoot'}.
    '/announcement.txt')) {
    print $store $announcement;
    close $store;
    print $client "ok\n";
       } else {
    print $client "error: ".($!+0)."\n";
       }
    } else {
       Reply($client, "refused\n", $userinput);
       
    }
   # ------------------------------------------------------------------ Hanging up
       } elsif (($userinput =~ /^exit/) ||
        ($userinput =~ /^init/)) { # no restrictions.
    &logthis(
    "Client $clientip ($clientname) hanging up: $userinput");
    print $client "bye\n";
    $client->shutdown(2);        # shutdown the socket forcibly.
    $client->close();
    return 0;
   
   # ---------------------------------- set current host/domain
       } elsif ($userinput =~ /^sethost:/) {
    if (isClient) {
       print $client &sethost($userinput)."\n";
    } else {
       print $client "refused\n";
    }
   #---------------------------------- request file (?) version.
       } elsif ($userinput =~/^version:/) {
    if (isClient) {
       print $client &version($userinput)."\n";
    } else {
       print $client "refused\n";
    }
   #------------------------------- is auto-enrollment enabled?
       } elsif ($userinput =~/^autorun:/) {
    if (isClient) {
       my ($cmd,$cdom) = split(/:/,$userinput);
       my $outcome = &localenroll::run($cdom);
       print $client "$outcome\n";
    } else {
       print $client "0\n";
    }
   #------------------------------- get official sections (for auto-enrollment).
       } elsif ($userinput =~/^autogetsections:/) {
    if (isClient) {
       my ($cmd,$coursecode,$cdom)=split(/:/,$userinput);
       my @secs = &localenroll::get_sections($coursecode,$cdom);
       my $seclist = &escape(join(':',@secs));
       print $client "$seclist\n";
    } else {
       print $client "refused\n";
    }
   #----------------------- validate owner of new course section (for auto-enrollment).
       } elsif ($userinput =~/^autonewcourse:/) {
    if (isClient) {
       my ($cmd,$inst_course_id,$owner,$cdom)=split(/:/,$userinput);
       my $outcome = &localenroll::new_course($inst_course_id,$owner,$cdom);
       print $client "$outcome\n";
    } else {
       print $client "refused\n";
    }
   #-------------- validate course section in schedule of classes (for auto-enrollment).
       } elsif ($userinput =~/^autovalidatecourse:/) {
    if (isClient) {
       my ($cmd,$inst_course_id,$cdom)=split(/:/,$userinput);
       my $outcome=&localenroll::validate_courseID($inst_course_id,$cdom);
       print $client "$outcome\n";
    } else {
       print $client "refused\n";
    }
   #--------------------------- create password for new user (for auto-enrollment).
       } elsif ($userinput =~/^autocreatepassword:/) {
    if (isClient) {
       my ($cmd,$authparam,$cdom)=split(/:/,$userinput);
       my ($create_passwd,$authchk);
       ($authparam,$create_passwd,$authchk) = &localenroll::create_password($authparam,$cdom);
       print $client &escape($authparam.':'.$create_passwd.':'.$authchk)."\n";
    } else {
       print $client "refused\n";
    }
   #---------------------------  read and remove temporary files (for auto-enrollment).
       } elsif ($userinput =~/^autoretrieve:/) {
    if (isClient) {
       my ($cmd,$filename) = split(/:/,$userinput);
       my $source = $perlvar{'lonDaemons'}.'/tmp/'.$filename;
       if ( (-e $source) && ($filename ne '') ) {
    my $reply = '';
    if (open(my $fh,$source)) {
       while (<$fh>) {
    chomp($_);
    $_ =~ s/^\s+//g;
    $_ =~ s/\s+$//g;
    $reply .= $_;
       }
       close($fh);
       print $client &escape($reply)."\n";
   #                                unlink($source);
    } else {
       print $client "error\n";
    }
       } else {
    print $client "error\n";
       }
    } else {
       print $client "refused\n";
    }
   #---------------------  read and retrieve institutional code format (for support form).
       } elsif ($userinput =~/^autoinstcodeformat:/) {
    if (isClient) {
       my $reply;
       my($cmd,$cdom,$course) = split(/:/,$userinput);
       my @pairs = split/\&/,$course;
       my %instcodes = ();
       my %codes = ();
       my @codetitles = ();
       my %cat_titles = ();
       my %cat_order = ();
       foreach (@pairs) {
    my ($key,$value) = split/=/,$_;
    $instcodes{&unescape($key)} = &unescape($value);
       }
       my $formatreply = &localenroll::instcode_format($cdom,\%instcodes,\%codes,\@codetitles,\%cat_titles,\%cat_order);
       if ($formatreply eq 'ok') {
    my $codes_str = &hash2str(%codes);
    my $codetitles_str = &array2str(@codetitles);
    my $cat_titles_str = &hash2str(%cat_titles);
    my $cat_order_str = &hash2str(%cat_order);
    print $client $codes_str.':'.$codetitles_str.':'.$cat_titles_str.':'.$cat_order_str."\n";
       }
    } else {
       print $client "refused\n";
    }
   # ------------------------------------------------------------- unknown command
   
       } else {
    # unknown command
    print $client "unknown_cmd\n";
       }
   # -------------------------------------------------------------------- complete
       Debug("process_request - returning 1");
       return 1;
   }
   #
   #   Decipher encoded traffic
   #  Parameters:
   #     input      - Encoded data.
   #  Returns:
   #     Decoded data or undef if encryption key was not yet negotiated.
   #  Implicit input:
   #     cipher  - This global holds the negotiated encryption key.
   #
   sub decipher {
       my ($input)  = @_;
       my $output = '';
       
       
       if($cipher) {
    my($enc, $enclength, $encinput) = split(/:/, $input);
    for(my $encidx = 0; $encidx < length($encinput); $encidx += 16) {
       $output .= 
    $cipher->decrypt(pack("H16", substr($encinput, $encidx, 16)));
    }
    return substr($output, 0, $enclength);
       } else {
    return undef;
       }
   }
   
   #
   #   Register a command processor.  This function is invoked to register a sub
   #   to process a request.  Once registered, the ProcessRequest sub can automatically
   #   dispatch requests to an appropriate sub, and do the top level validity checking
   #   as well:
   #    - Is the keyword recognized.
   #    - Is the proper client type attempting the request.
   #    - Is the request encrypted if it has to be.
   #   Parameters:
   #    $request_name         - Name of the request being registered.
   #                           This is the command request that will match
   #                           against the hash keywords to lookup the information
   #                           associated with the dispatch information.
   #    $procedure           - Reference to a sub to call to process the request.
   #                           All subs get called as follows:
   #                             Procedure($cmd, $tail, $replyfd, $key)
   #                             $cmd    - the actual keyword that invoked us.
   #                             $tail   - the tail of the request that invoked us.
   #                             $replyfd- File descriptor connected to the client
   #    $must_encode          - True if the request must be encoded to be good.
   #    $client_ok            - True if it's ok for a client to request this.
   #    $manager_ok           - True if it's ok for a manager to request this.
   # Side effects:
   #      - On success, the Dispatcher hash has an entry added for the key $RequestName
   #      - On failure, the program will die as it's a bad internal bug to try to 
   #        register a duplicate command handler.
   #
   sub register_handler {
       my ($request_name,$procedure,$must_encode, $client_ok,$manager_ok)   = @_;
   
       #  Don't allow duplication#
      
       if (defined $Dispatcher{$request_name}) {
    die "Attempting to define a duplicate request handler for $request_name\n";
       }
       #   Build the client type mask:
       
       my $client_type_mask = 0;
       if($client_ok) {
    $client_type_mask  |= $CLIENT_OK;
       }
       if($manager_ok) {
    $client_type_mask  |= $MANAGER_OK;
       }
      
       #  Enter the hash:
         
       my @entry = ($procedure, $must_encode, $client_type_mask);
      
       $Dispatcher{$request_name} = \@entry;
      
      
   }
   
   
   #------------------------------------------------------------------
   
   
   
   
 #  #
 #  Convert an error return code from lcpasswd to a string value.  #  Convert an error return code from lcpasswd to a string value.
 #  #
Line 863  sub HUPSMAN {                      # sig Line 2994  sub HUPSMAN {                      # sig
 #  #
 #    Kill off hashes that describe the host table prior to re-reading it.  #    Kill off hashes that describe the host table prior to re-reading it.
 #    Hashes affected are:  #    Hashes affected are:
 #       %hostid, %hostdom %hostip  #       %hostid, %hostdom %hostip %hostdns.
 #  #
 sub KillHostHashes {  sub KillHostHashes {
     foreach my $key (keys %hostid) {      foreach my $key (keys %hostid) {
Line 875  sub KillHostHashes { Line 3006  sub KillHostHashes {
     foreach my $key (keys %hostip) {      foreach my $key (keys %hostip) {
  delete $hostip{$key};   delete $hostip{$key};
     }      }
       foreach my $key (keys %hostdns) {
    delete $hostdns{$key};
       }
 }  }
 #  #
 #   Read in the host table from file and distribute it into the various hashes:  #   Read in the host table from file and distribute it into the various hashes:
Line 885  sub KillHostHashes { Line 3019  sub KillHostHashes {
 sub ReadHostTable {  sub ReadHostTable {
   
     open (CONFIG,"$perlvar{'lonTabDir'}/hosts.tab") || die "Can't read host file";      open (CONFIG,"$perlvar{'lonTabDir'}/hosts.tab") || die "Can't read host file";
           my $myloncapaname = $perlvar{'lonHostID'};
       Debug("My loncapa name is : $myloncapaname");
     while (my $configline=<CONFIG>) {      while (my $configline=<CONFIG>) {
  if (!($configline =~ /^\s*\#/)) {   if (!($configline =~ /^\s*\#/)) {
     my ($id,$domain,$role,$name,$ip)=split(/:/,$configline);      my ($id,$domain,$role,$name,$ip)=split(/:/,$configline);
     chomp($ip); $ip=~s/\D+$//;      chomp($ip); $ip=~s/\D+$//;
     $hostid{$ip}=$id;      $hostid{$ip}=$id;         # LonCAPA name of host by IP.
     $hostdom{$id}=$domain;      $hostdom{$id}=$domain;    # LonCAPA domain name of host. 
     $hostip{$id}=$ip;      $hostip{$id}=$ip;      # IP address of host.
     if ($id eq $perlvar{'lonHostID'}) { $thisserver=$name; }      $hostdns{$name} = $id;    # LonCAPA name of host by DNS.
   
       if ($id eq $perlvar{'lonHostID'}) { 
    Debug("Found me in the host table: $name");
    $thisserver=$name; 
       }
  }   }
     }      }
     close(CONFIG);      close(CONFIG);
Line 963  sub checkchildren { Line 3103  sub checkchildren {
         }           } 
     }      }
     sleep 5;      sleep 5;
     $SIG{ALRM} = sub { die "timeout" };      $SIG{ALRM} = sub { Debug("timeout"); 
          die "timeout";  };
     $SIG{__DIE__} = 'DEFAULT';      $SIG{__DIE__} = 'DEFAULT';
     &status("Checking on the children (waiting for reports)");      &status("Checking on the children (waiting for reports)");
     foreach (sort keys %children) {      foreach (sort keys %children) {
Line 1015  sub Debug { Line 3156  sub Debug {
 #     request - Original request from client.  #     request - Original request from client.
 #  #
 sub Reply {  sub Reply {
     my $fd      = shift;      my ($fd, $reply, $request) = @_;
     my $reply   = shift;  
     my $request = shift;  
   
     print $fd $reply;      print $fd $reply;
     Debug("Request was $request  Reply was $reply");      Debug("Request was $request  Reply was $reply");
   
       $Transactions++;
   
   
   }
   
   
   #
   #    Sub to report a failure.
   #    This function:
   #     -   Increments the failure statistic counters.
   #     -   Invokes Reply to send the error message to the client.
   # Parameters:
   #    fd       - File descriptor open on the client
   #    reply    - Reply text to emit.
   #    request  - The original request message (used by Reply
   #               to debug if that's enabled.
   # Implicit outputs:
   #    $Failures- The number of failures is incremented.
   #    Reply (invoked here) sends a message to the 
   #    client:
   #
   sub Failure {
       my $fd      = shift;
       my $reply   = shift;
       my $request = shift;
      
       $Failures++;
       Reply($fd, $reply, $request);      # That's simple eh?
 }  }
 # ------------------------------------------------------------------ Log status  # ------------------------------------------------------------------ Log status
   
Line 1030  sub logstatus { Line 3196  sub logstatus {
     my $docdir=$perlvar{'lonDocRoot'};      my $docdir=$perlvar{'lonDocRoot'};
     {      {
     my $fh=IO::File->new(">>$docdir/lon-status/londstatus.txt");      my $fh=IO::File->new(">>$docdir/lon-status/londstatus.txt");
     print $fh $$."\t".$clientname."\t".$currenthostid."\t".$status."\t".$lastlog."\n";      print $fh $$."\t".$clientname."\t".$currenthostid."\t"
    .$status."\t".$lastlog."\t $keymode\n";
     $fh->close();      $fh->close();
     }      }
     &status("Finished londstatus.txt");      &status("Finished londstatus.txt");
     {      {
  my $fh=IO::File->new(">$docdir/lon-status/londchld/$$.txt");   my $fh=IO::File->new(">$docdir/lon-status/londchld/$$.txt");
         print $fh $status."\n".$lastlog."\n".time;          print $fh $status."\n".$lastlog."\n".time."\n$keymode";
         $fh->close();          $fh->close();
     }      }
     &status("Finished logging");      &status("Finished logging");
Line 1236  while (1) { Line 3403  while (1) {
   
 sub make_new_child {  sub make_new_child {
     my $pid;      my $pid;
     my $cipher;  #    my $cipher;     # Now global
     my $sigset;      my $sigset;
   
     $client = shift;      $client = shift;
Line 1265  sub make_new_child { Line 3432  sub make_new_child {
  &logthis("Unable to determine who caller was, getpeername returned nothing");   &logthis("Unable to determine who caller was, getpeername returned nothing");
     }      }
     if (defined($iaddr)) {      if (defined($iaddr)) {
  $clientip=inet_ntoa($iaddr);   $clientip  = inet_ntoa($iaddr);
    Debug("Connected with $clientip");
    $clientdns = gethostbyaddr($iaddr, AF_INET);
    Debug("Connected with $clientdns by name");
     } else {      } else {
  &logthis("Unable to determine clinetip");   &logthis("Unable to determine clientip");
  $clientip='Unavailable';   $clientip='Unavailable';
     }      }
           
Line 1292  sub make_new_child { Line 3462  sub make_new_child {
         sigprocmask(SIG_UNBLOCK, $sigset)          sigprocmask(SIG_UNBLOCK, $sigset)
             or die "Can't unblock SIGINT for fork: $!\n";              or die "Can't unblock SIGINT for fork: $!\n";
   
         my $tmpsnum=0;  #        my $tmpsnum=0;            # Now global
 #---------------------------------------------------- kerberos 5 initialization  #---------------------------------------------------- kerberos 5 initialization
         &Authen::Krb5::init_context();          &Authen::Krb5::init_context();
         &Authen::Krb5::init_ets();          &Authen::Krb5::init_ets();
Line 1301  sub make_new_child { Line 3471  sub make_new_child {
 # =============================================================================  # =============================================================================
             # do something with the connection              # do something with the connection
 # -----------------------------------------------------------------------------  # -----------------------------------------------------------------------------
  # see if we know client and check for spoof IP by challenge   # see if we know client and 'check' for spoof IP by ineffective challenge
   
  ReadManagerTable; # May also be a manager!!   ReadManagerTable; # May also be a manager!!
   
Line 1319  sub make_new_child { Line 3489  sub make_new_child {
     $clientname = $managers{$clientip};      $clientname = $managers{$clientip};
  }   }
  my $clientok;   my $clientok;
   
  if ($clientrec || $ismanager) {   if ($clientrec || $ismanager) {
     &status("Waiting for init from $clientip $clientname");      &status("Waiting for init from $clientip $clientname");
     &logthis('<font color="yellow">INFO: Connection, '.      &logthis('<font color="yellow">INFO: Connection, '.
Line 1326  sub make_new_child { Line 3497  sub make_new_child {
   " ($clientname) connection type = $ConnectionType </font>" );    " ($clientname) connection type = $ConnectionType </font>" );
     &status("Connecting $clientip  ($clientname))");       &status("Connecting $clientip  ($clientname))"); 
     my $remotereq=<$client>;      my $remotereq=<$client>;
     $remotereq=~s/[^\w:]//g;      chomp($remotereq);
       Debug("Got init: $remotereq");
       my $inikeyword = split(/:/, $remotereq);
     if ($remotereq =~ /^init/) {      if ($remotereq =~ /^init/) {
  &sethost("sethost:$perlvar{'lonHostID'}");   &sethost("sethost:$perlvar{'lonHostID'}");
  my $challenge="$$".time;   #
  print $client "$challenge\n";   #  If the remote is attempting a local init... give that a try:
  &status(   #
  "Waiting for challenge reply from $clientip ($clientname)");    my ($i, $inittype) = split(/:/, $remotereq);
  $remotereq=<$client>;  
  $remotereq=~s/\W//g;   # If the connection type is ssl, but I didn't get my
  if ($challenge eq $remotereq) {   # certificate files yet, then I'll drop  back to 
     $clientok=1;   # insecure (if allowed).
     print $client "ok\n";  
    if($inittype eq "ssl") {
       my ($ca, $cert) = lonssl::CertificateFile;
       my $kfile       = lonssl::KeyFile;
       if((!$ca)   || 
          (!$cert) || 
          (!$kfile)) {
    $inittype = ""; # This forces insecure attempt.
    &logthis("<font color=\"blue\"> Certificates not "
    ."installed -- trying insecure auth</font>");
       }
       else { # SSL certificates are in place so
       } # Leave the inittype alone.
    }
   
    if($inittype eq "local") {
       my $key = LocalConnection($client, $remotereq);
       if($key) {
    Debug("Got local key $key");
    $clientok     = 1;
    my $cipherkey = pack("H32", $key);
    $cipher       = new IDEA($cipherkey);
    print $client "ok:local\n";
    &logthis('<font color="green"'
    . "Successful local authentication </font>");
    $keymode = "local"
       } else {
    Debug("Failed to get local key");
    $clientok = 0;
    shutdown($client, 3);
    close $client;
       }
    } elsif ($inittype eq "ssl") {
       my $key = SSLConnection($client);
       if ($key) {
    $clientok = 1;
    my $cipherkey = pack("H32", $key);
    $cipher       = new IDEA($cipherkey);
    &logthis('<font color="green">'
    ."Successfull ssl authentication with $clientname </font>");
    $keymode = "ssl";
        
       } else {
    $clientok = 0;
    close $client;
       }
      
  } else {   } else {
     &logthis(      my $ok = InsecureConnection($client);
      "<font color='blue'>WARNING: $clientip did not reply challenge</font>");      if($ok) {
     &status('No challenge reply '.$clientip);   $clientok = 1;
    &logthis('<font color="green">'
    ."Successful insecure authentication with $clientname </font>");
    print $client "ok\n";
    $keymode = "insecure";
       } else {
    &logthis('<font color="yellow">'
     ."Attempted insecure connection disallowed </font>");
    close $client;
    $clientok = 0;
   
       }
  }   }
     } else {      } else {
  &logthis(   &logthis(
Line 1349  sub make_new_child { Line 3579  sub make_new_child {
  ."$clientip failed to initialize: >$remotereq< </font>");   ."$clientip failed to initialize: >$remotereq< </font>");
  &status('No init '.$clientip);   &status('No init '.$clientip);
     }      }
       
  } else {   } else {
     &logthis(      &logthis(
      "<font color='blue'>WARNING: Unknown client $clientip</font>");       "<font color='blue'>WARNING: Unknown client $clientip</font>");
     &status('Hung up on '.$clientip);      &status('Hung up on '.$clientip);
  }   }
    
  if ($clientok) {   if ($clientok) {
 # ---------------- New known client connecting, could mean machine online again  # ---------------- New known client connecting, could mean machine online again
           
Line 1368  sub make_new_child { Line 3600  sub make_new_child {
     &logthis("<font color='green'>Established connection: $clientname</font>");      &logthis("<font color='green'>Established connection: $clientname</font>");
     &status('Will listen to '.$clientname);      &status('Will listen to '.$clientname);
 # ------------------------------------------------------------ Process requests  # ------------------------------------------------------------ Process requests
     while (my $userinput=<$client>) {      my $keep_going = 1;
                 chomp($userinput);      my $user_input;
  Debug("Request = $userinput\n");      while(($user_input = get_request) && $keep_going) {
                 &status('Processing '.$clientname.': '.$userinput);   alarm(120);
                 my $wasenc=0;   Debug("Main: Got $user_input\n");
                 alarm(120);   $keep_going = &process_request($user_input);
 # ------------------------------------------------------------ See if encrypted  
  if ($userinput =~ /^enc/) {  
     if ($cipher) {  
  my ($cmd,$cmdlength,$encinput)=split(/:/,$userinput);  
  $userinput='';  
  for (my $encidx=0;$encidx<length($encinput);$encidx+=16) {  
     $userinput.=  
  $cipher->decrypt(  
  pack("H16",substr($encinput,$encidx,16))  
  );  
  }  
  $userinput=substr($userinput,0,$cmdlength);  
  $wasenc=1;  
     }  
  }  
   
 # ------------------------------------------------------------- Normal commands  
 # ------------------------------------------------------------------------ ping  
  if ($userinput =~ /^ping/) { # client only  
     if(isClient) {  
  print $client "$currenthostid\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
     }  
 # ------------------------------------------------------------------------ pong  
  }elsif ($userinput =~ /^pong/) { # client only  
     if(isClient) {  
  my $reply=&reply("ping",$clientname);  
  print $client "$currenthostid:$reply\n";   
     } else {  
  Reply($client, "refused\n", $userinput);  
     }  
 # ------------------------------------------------------------------------ ekey  
  } elsif ($userinput =~ /^ekey/) { # ok for both clients & mgrs  
     my $buildkey=time.$$.int(rand 100000);  
     $buildkey=~tr/1-6/A-F/;  
     $buildkey=int(rand 100000).$buildkey.int(rand 100000);  
     my $key=$currenthostid.$clientname;  
     $key=~tr/a-z/A-Z/;  
     $key=~tr/G-P/0-9/;  
     $key=~tr/Q-Z/0-9/;  
     $key=$key.$buildkey.$key.$buildkey.$key.$buildkey;  
     $key=substr($key,0,32);  
     my $cipherkey=pack("H32",$key);  
     $cipher=new IDEA $cipherkey;  
     print $client "$buildkey\n";   
 # ------------------------------------------------------------------------ load  
  } elsif ($userinput =~ /^load/) { # client only  
     if (isClient) {  
  my $loadavg;  
  {  
     my $loadfile=IO::File->new('/proc/loadavg');  
     $loadavg=<$loadfile>;  
  }  
  $loadavg =~ s/\s.*//g;  
  my $loadpercent=100*$loadavg/$perlvar{'lonLoadLim'};  
  print $client "$loadpercent\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # -------------------------------------------------------------------- userload  
  } elsif ($userinput =~ /^userload/) { # client only  
     if(isClient) {  
  my $userloadpercent=&userload();  
  print $client "$userloadpercent\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
        
     }  
 #  
 #        Transactions requiring encryption:  
 #  
 # ----------------------------------------------------------------- currentauth  
  } elsif ($userinput =~ /^currentauth/) {  
     if (($wasenc==1)  && isClient) { # Encoded & client only.  
  my ($cmd,$udom,$uname)=split(/:/,$userinput);  
  my $result = GetAuthType($udom, $uname);  
  if($result eq "nouser") {  
     print $client "unknown_user\n";  
  }  
  else {  
     print $client "$result\n"  
     }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 #--------------------------------------------------------------------- pushfile  
  } elsif($userinput =~ /^pushfile/) { # encoded & manager.  
     if(($wasenc == 1) && isManager) {  
  my $cert = GetCertificate($userinput);  
  if(ValidManager($cert)) {  
     my $reply = PushFile($userinput);  
     print $client "$reply\n";  
  } else {  
     print $client "refused\n";  
  }   
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 #--------------------------------------------------------------------- reinit  
  } elsif($userinput =~ /^reinit/) { # Encoded and manager  
  if (($wasenc == 1) && isManager) {  
  my $cert = GetCertificate($userinput);  
  if(ValidManager($cert)) {  
  chomp($userinput);  
  my $reply = ReinitProcess($userinput);  
  print $client  "$reply\n";  
  } else {  
  print $client "refused\n";  
  }  
  } else {  
  Reply($client, "refused\n", $userinput);  
  }  
 #------------------------------------------------------------------------- edit  
     } elsif ($userinput =~ /^edit/) {    # encoded and manager:  
  if(($wasenc ==1) && (isManager)) {  
     my $cert = GetCertificate($userinput);  
     if(ValidManager($cert)) {  
                my($command, $filetype, $script) = split(/:/, $userinput);  
                if (($filetype eq "hosts") || ($filetype eq "domain")) {  
                   if($script ne "") {  
       Reply($client, EditFile($userinput));  
                   } else {  
                      Reply($client,"refused\n",$userinput);  
                   }  
                } else {  
                   Reply($client,"refused\n",$userinput);  
                }  
             } else {  
                Reply($client,"refused\n",$userinput);  
             }  
          } else {  
      Reply($client,"refused\n",$userinput);  
  }  
 # ------------------------------------------------------------------------ auth  
     } elsif ($userinput =~ /^auth/) { # Encoded and client only.  
     if (($wasenc==1) && isClient) {  
  my ($cmd,$udom,$uname,$upass)=split(/:/,$userinput);  
  chomp($upass);  
  $upass=unescape($upass);  
  my $proname=propath($udom,$uname);  
  my $passfilename="$proname/passwd";  
  if (-e $passfilename) {  
     my $pf = IO::File->new($passfilename);  
     my $realpasswd=<$pf>;  
     chomp($realpasswd);  
     my ($howpwd,$contentpwd)=split(/:/,$realpasswd);  
     my $pwdcorrect=0;  
     if ($howpwd eq 'internal') {  
  &Debug("Internal auth");  
  $pwdcorrect=  
     (crypt($upass,$contentpwd) eq $contentpwd);  
     } elsif ($howpwd eq 'unix') {  
  &Debug("Unix auth");  
  if((getpwnam($uname))[1] eq "") { #no such user!  
     $pwdcorrect = 0;  
  } else {  
     $contentpwd=(getpwnam($uname))[1];  
     my $pwauth_path="/usr/local/sbin/pwauth";  
     unless ($contentpwd eq 'x') {  
  $pwdcorrect=  
     (crypt($upass,$contentpwd) eq   
      $contentpwd);  
     }  
       
     elsif (-e $pwauth_path) {  
  open PWAUTH, "|$pwauth_path" or  
     die "Cannot invoke authentication";  
  print PWAUTH "$uname\n$upass\n";  
  close PWAUTH;  
  $pwdcorrect=!$?;  
     }  
  }  
     } elsif ($howpwd eq 'krb4') {  
  my $null=pack("C",0);  
  unless ($upass=~/$null/) {  
     my $krb4_error = &Authen::Krb4::get_pw_in_tkt  
  ($uname,"",$contentpwd,'krbtgt',  
  $contentpwd,1,$upass);  
     if (!$krb4_error) {  
  $pwdcorrect = 1;  
     } else {   
  $pwdcorrect=0;   
  # log error if it is not a bad password  
  if ($krb4_error != 62) {  
     &logthis('krb4:'.$uname.','.$contentpwd.','.  
      &Authen::Krb4::get_err_txt($Authen::Krb4::error));  
  }  
     }  
  }  
     } elsif ($howpwd eq 'krb5') {  
  my $null=pack("C",0);  
  unless ($upass=~/$null/) {  
     my $krbclient=&Authen::Krb5::parse_name($uname.'@'.$contentpwd);  
     my $krbservice="krbtgt/".$contentpwd."\@".$contentpwd;  
     my $krbserver=&Authen::Krb5::parse_name($krbservice);  
     my $credentials=&Authen::Krb5::cc_default();  
     $credentials->initialize($krbclient);  
     my $krbreturn =   
  &Authen::Krb5::get_in_tkt_with_password(  
  $krbclient,$krbserver,$upass,$credentials);  
 #  unless ($krbreturn) {  
 #      &logthis("Krb5 Error: ".  
 #       &Authen::Krb5::error());  
 #  }  
     $pwdcorrect = ($krbreturn == 1);  
  } else { $pwdcorrect=0; }  
     } elsif ($howpwd eq 'localauth') {  
  $pwdcorrect=&localauth::localauth($uname,$upass,  
   $contentpwd);  
     }  
     if ($pwdcorrect) {  
  print $client "authorized\n";  
     } else {  
  print $client "non_authorized\n";  
     }    
  } else {  
     print $client "unknown_user\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ---------------------------------------------------------------------- passwd  
  } elsif ($userinput =~ /^passwd/) { # encoded and client  
     if (($wasenc==1) && isClient) {  
  my   
     ($cmd,$udom,$uname,$upass,$npass)=split(/:/,$userinput);  
  chomp($npass);  
  $upass=&unescape($upass);  
  $npass=&unescape($npass);  
  &Debug("Trying to change password for $uname");  
  my $proname=propath($udom,$uname);  
  my $passfilename="$proname/passwd";  
  if (-e $passfilename) {  
     my $realpasswd;  
     { my $pf = IO::File->new($passfilename);  
       $realpasswd=<$pf>; }  
     chomp($realpasswd);  
     my ($howpwd,$contentpwd)=split(/:/,$realpasswd);  
     if ($howpwd eq 'internal') {  
  &Debug("internal auth");  
  if (crypt($upass,$contentpwd) eq $contentpwd) {  
     my $salt=time;  
     $salt=substr($salt,6,2);  
     my $ncpass=crypt($npass,$salt);  
     {  
  my $pf;  
  if ($pf = IO::File->new(">$passfilename")) {  
     print $pf "internal:$ncpass\n";  
     &logthis("Result of password change for $uname: pwchange_success");  
     print $client "ok\n";  
  } else {  
     &logthis("Unable to open $uname passwd to change password");  
     print $client "non_authorized\n";  
  }  
     }               
       
  } else {  
     print $client "non_authorized\n";  
  }  
     } elsif ($howpwd eq 'unix') {  
  # Unix means we have to access /etc/password  
  # one way or another.  
  # First: Make sure the current password is  
  #        correct  
  &Debug("auth is unix");  
  $contentpwd=(getpwnam($uname))[1];  
  my $pwdcorrect = "0";  
  my $pwauth_path="/usr/local/sbin/pwauth";  
  unless ($contentpwd eq 'x') {  
     $pwdcorrect=  
  (crypt($upass,$contentpwd) eq $contentpwd);  
  } elsif (-e $pwauth_path) {  
     open PWAUTH, "|$pwauth_path" or  
  die "Cannot invoke authentication";  
     print PWAUTH "$uname\n$upass\n";  
     close PWAUTH;  
     &Debug("exited pwauth with $? ($uname,$upass) ");  
     $pwdcorrect=($? == 0);  
  }  
  if ($pwdcorrect) {  
     my $execdir=$perlvar{'lonDaemons'};  
     &Debug("Opening lcpasswd pipeline");  
     my $pf = IO::File->new("|$execdir/lcpasswd > $perlvar{'lonDaemons'}/logs/lcpasswd.log");  
     print $pf "$uname\n$npass\n$npass\n";  
     close $pf;  
     my $err = $?;  
     my $result = ($err>0 ? 'pwchange_failure'   
   : 'ok');  
     &logthis("Result of password change for $uname: ".  
      &lcpasswdstrerror($?));  
     print $client "$result\n";  
  } else {  
     print $client "non_authorized\n";  
  }  
     } else {  
  print $client "auth_mode_error\n";  
     }    
  } else {  
     print $client "unknown_user\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # -------------------------------------------------------------------- makeuser  
  } elsif ($userinput =~ /^makeuser/) { # encoded and client.  
     &Debug("Make user received");  
     my $oldumask=umask(0077);  
     if (($wasenc==1) && isClient) {  
  my   
     ($cmd,$udom,$uname,$umode,$npass)=split(/:/,$userinput);  
  &Debug("cmd =".$cmd." $udom =".$udom.  
        " uname=".$uname);  
  chomp($npass);  
  $npass=&unescape($npass);  
  my $proname=propath($udom,$uname);  
  my $passfilename="$proname/passwd";  
  &Debug("Password file created will be:".  
        $passfilename);  
  if (-e $passfilename) {  
     print $client "already_exists\n";  
  } elsif ($udom ne $currentdomainid) {  
     print $client "not_right_domain\n";  
  } else {  
     my @fpparts=split(/\//,$proname);  
     my $fpnow=$fpparts[0].'/'.$fpparts[1].'/'.$fpparts[2];  
     my $fperror='';  
     for (my $i=3;$i<=$#fpparts;$i++) {  
  $fpnow.='/'.$fpparts[$i];   
  unless (-e $fpnow) {  
     unless (mkdir($fpnow,0777)) {  
  $fperror="error: ".($!+0)  
     ." mkdir failed while attempting "  
     ."makeuser";  
     }  
  }  
     }  
     unless ($fperror) {  
  my $result=&make_passwd_file($uname, $umode,$npass,  
      $passfilename);  
  print $client $result;  
     } else {  
  print $client "$fperror\n";  
     }  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
         
     }  
     umask($oldumask);  
 # -------------------------------------------------------------- changeuserauth  
  } elsif ($userinput =~ /^changeuserauth/) { # encoded & client  
     &Debug("Changing authorization");  
     if (($wasenc==1) && isClient) {  
  my   
     ($cmd,$udom,$uname,$umode,$npass)=split(/:/,$userinput);  
  chomp($npass);  
  &Debug("cmd = ".$cmd." domain= ".$udom.  
        "uname =".$uname." umode= ".$umode);  
  $npass=&unescape($npass);  
  my $proname=&propath($udom,$uname);  
  my $passfilename="$proname/passwd";  
  if ($udom ne $currentdomainid) {  
     print $client "not_right_domain\n";  
  } else {  
     my $result=&make_passwd_file($uname, $umode,$npass,  
  $passfilename);  
     print $client $result;  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
      
     }  
 # ------------------------------------------------------------------------ home  
  } elsif ($userinput =~ /^home/) { # client clear or encoded  
     if(isClient) {  
  my ($cmd,$udom,$uname)=split(/:/,$userinput);  
  chomp($uname);  
  my $proname=propath($udom,$uname);  
  if (-e $proname) {  
     print $client "found\n";  
  } else {  
     print $client "not_found\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ---------------------------------------------------------------------- update  
  } elsif ($userinput =~ /^update/) { # client clear or encoded.  
     if(isClient) {  
  my ($cmd,$fname)=split(/:/,$userinput);  
  my $ownership=ishome($fname);  
  if ($ownership eq 'not_owner') {  
     if (-e $fname) {  
  my ($dev,$ino,$mode,$nlink,  
     $uid,$gid,$rdev,$size,  
     $atime,$mtime,$ctime,  
     $blksize,$blocks)=stat($fname);  
  my $now=time;  
  my $since=$now-$atime;  
  if ($since>$perlvar{'lonExpire'}) {  
     my $reply=  
  &reply("unsub:$fname","$clientname");  
     unlink("$fname");  
  } else {  
     my $transname="$fname.in.transfer";  
     my $remoteurl=  
  &reply("sub:$fname","$clientname");  
     my $response;  
     {  
  my $ua=new LWP::UserAgent;  
  my $request=new HTTP::Request('GET',"$remoteurl");  
  $response=$ua->request($request,$transname);  
     }  
     if ($response->is_error()) {  
  unlink($transname);  
  my $message=$response->status_line;  
  &logthis(  
  "LWP GET: $message for $fname ($remoteurl)");  
     } else {  
  if ($remoteurl!~/\.meta$/) {  
     my $ua=new LWP::UserAgent;  
     my $mrequest=  
  new HTTP::Request('GET',$remoteurl.'.meta');  
     my $mresponse=  
  $ua->request($mrequest,$fname.'.meta');  
     if ($mresponse->is_error()) {  
  unlink($fname.'.meta');  
     }  
  }  
  rename($transname,$fname);  
     }  
  }  
  print $client "ok\n";  
     } else {  
  print $client "not_found\n";  
     }  
  } else {  
     print $client "rejected\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # -------------------------------------- fetch a user file from a remote server  
  } elsif ($userinput =~ /^fetchuserfile/) { # Client clear or enc.  
     if(isClient) {  
  my ($cmd,$fname)=split(/:/,$userinput);  
  my ($udom,$uname,$ufile) = ($fname =~ m|^([^/]+)/([^/]+)/(.+)$|);  
  my $udir=propath($udom,$uname).'/userfiles';  
  unless (-e $udir) { mkdir($udir,0770); }  
  if (-e $udir) {  
                             $ufile=~s/^[\.\~]+//;  
                             my $path = $udir;  
                             if ($ufile =~m|(.+)/([^/]+)$|) {  
                                 my @parts=split('/',$1);  
                                 foreach my $part (@parts) {  
                                     $path .= '/'.$part;  
                                     if ((-e $path)!=1) {  
                                         mkdir($path,0770);  
                                     }  
                                 }  
                             }  
     my $destname=$udir.'/'.$ufile;  
     my $transname=$udir.'/'.$ufile.'.in.transit';  
     my $remoteurl='http://'.$clientip.'/userfiles/'.$fname;  
     my $response;  
     {  
  my $ua=new LWP::UserAgent;  
  my $request=new HTTP::Request('GET',"$remoteurl");  
  $response=$ua->request($request,$transname);  
     }  
     if ($response->is_error()) {  
  unlink($transname);  
  my $message=$response->status_line;  
  &logthis("LWP GET: $message for $fname ($remoteurl)");  
  print $client "failed\n";  
     } else {  
  if (!rename($transname,$destname)) {  
     &logthis("Unable to move $transname to $destname");  
     unlink($transname);  
     print $client "failed\n";  
  } else {  
     print $client "ok\n";  
  }  
     }  
  } else {  
     print $client "not_home\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
     }  
 # --------------------------------------------------------- remove a user file   
  } elsif ($userinput =~ /^removeuserfile/) { # Client clear or enc.  
     if(isClient) {  
  my ($cmd,$fname)=split(/:/,$userinput);  
  my ($udom,$uname,$ufile) = ($fname =~ m|^([^/]+)/([^/]+)/(.+)$|);  
  &logthis("$udom - $uname - $ufile");  
  if ($ufile =~m|/\.\./|) {  
     # any files paths with /../ in them refuse   
                             # to deal with  
     print $client "refused\n";  
  } else {  
     my $udir=propath($udom,$uname);  
     if (-e $udir) {  
  my $file=$udir.'/userfiles/'.$ufile;  
  if (-e $file) {  
     unlink($file);  
     if (-e $file) {  
  print $client "failed\n";  
     } else {  
  print $client "ok\n";  
     }  
  } else {  
     print $client "not_found\n";  
  }  
     } else {  
  print $client "not_home\n";  
     }  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
     }  
 # ------------------------------------------ authenticate access to a user file  
  } elsif ($userinput =~ /^tokenauthuserfile/) { # Client only  
     if(isClient) {  
  my ($cmd,$fname,$session)=split(/:/,$userinput);  
  chomp($session);  
  my $reply='non_auth';  
  if (open(ENVIN,$perlvar{'lonIDsDir'}.'/'.  
  $session.'.id')) {  
     while (my $line=<ENVIN>) {  
  if ($line=~ m|userfile\.\Q$fname\E\=|) { $reply='ok'; }  
     }  
     close(ENVIN);  
     print $client $reply."\n";  
  } else {  
     print $client "invalid_token\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ----------------------------------------------------------------- unsubscribe  
  } elsif ($userinput =~ /^unsub/) {  
     if(isClient) {  
  my ($cmd,$fname)=split(/:/,$userinput);  
  if (-e $fname) {  
     print $client &unsub($fname,$clientip);  
  } else {  
     print $client "not_found\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ------------------------------------------------------------------- subscribe  
  } elsif ($userinput =~ /^sub/) {  
     if(isClient) {  
  print $client &subscribe($userinput,$clientip);  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ------------------------------------------------------------- current version  
  } elsif ($userinput =~ /^currentversion/) {  
     if(isClient) {  
  my ($cmd,$fname)=split(/:/,$userinput);  
  print $client &currentversion($fname)."\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ------------------------------------------------------------------------- log  
  } elsif ($userinput =~ /^log/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$what)=split(/:/,$userinput);  
  chomp($what);  
  my $proname=propath($udom,$uname);  
  my $now=time;  
  {  
     my $hfh;  
     if ($hfh=IO::File->new(">>$proname/activity.log")) {   
  print $hfh "$now:$clientname:$what\n";  
  print $client "ok\n";   
     } else {  
  print $client "error: ".($!+0)  
     ." IO::File->new Failed "  
     ."while attempting log\n";  
     }  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ------------------------------------------------------------------------- put  
  } elsif ($userinput =~ /^put/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$what)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  if ($namespace ne 'roles') {  
     chomp($what);  
     my $proname=propath($udom,$uname);  
     my $now=time;  
     unless ($namespace=~/^nohist\_/) {  
  my $hfh;  
  if (  
     $hfh=IO::File->new(">>$proname/$namespace.hist")  
     ) { print $hfh "P:$now:$what\n"; }  
     }  
     my @pairs=split(/\&/,$what);  
     my %hash;  
     if (tie(%hash,'GDBM_File',  
     "$proname/$namespace.db",  
     &GDBM_WRCREAT(),0640)) {  
  foreach my $pair (@pairs) {  
     my ($key,$value)=split(/=/,$pair);  
     $hash{$key}=$value;  
  }  
  if (untie(%hash)) {  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)  
  ." untie(GDBM) failed ".  
  "while attempting put\n";  
  }  
     } else {  
  print $client "error: ".($!)  
     ." tie(GDBM) Failed ".  
     "while attempting put\n";  
     }  
  } else {  
     print $client "refused\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ------------------------------------------------------------------- inc  
  } elsif ($userinput =~ /^inc:/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$what)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  if ($namespace ne 'roles') {  
     chomp($what);  
     my $proname=propath($udom,$uname);  
     my $now=time;  
     unless ($namespace=~/^nohist\_/) {  
  my $hfh;  
  if (  
     $hfh=IO::File->new(">>$proname/$namespace.hist")  
     ) { print $hfh "P:$now:$what\n"; }  
     }  
     my @pairs=split(/\&/,$what);  
     my %hash;  
     if (tie(%hash,'GDBM_File',  
     "$proname/$namespace.db",  
     &GDBM_WRCREAT(),0640)) {  
  foreach my $pair (@pairs) {  
     my ($key,$value)=split(/=/,$pair);  
                                     # We could check that we have a number...  
                                     if (! defined($value) || $value eq '') {  
                                         $value = 1;  
                                     }  
     $hash{$key}+=$value;  
  }  
  if (untie(%hash)) {  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)  
  ." untie(GDBM) failed ".  
  "while attempting inc\n";  
  }  
     } else {  
  print $client "error: ".($!)  
     ." tie(GDBM) Failed ".  
     "while attempting inc\n";  
     }  
  } else {  
     print $client "refused\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # -------------------------------------------------------------------- rolesput  
  } elsif ($userinput =~ /^rolesput/) {  
     if(isClient) {  
  &Debug("rolesput");  
  if ($wasenc==1) {  
     my ($cmd,$exedom,$exeuser,$udom,$uname,$what)  
  =split(/:/,$userinput);  
     &Debug("cmd = ".$cmd." exedom= ".$exedom.  
    "user = ".$exeuser." udom=".$udom.  
    "what = ".$what);  
     my $namespace='roles';  
     chomp($what);  
     my $proname=propath($udom,$uname);  
     my $now=time;  
     {  
  my $hfh;  
  if (  
     $hfh=IO::File->new(">>$proname/$namespace.hist")  
     ) {   
     print $hfh "P:$now:$exedom:$exeuser:$what\n";  
  }  
     }  
     my @pairs=split(/\&/,$what);  
     my %hash;  
     if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {  
  foreach my $pair (@pairs) {  
     my ($key,$value)=split(/=/,$pair);  
     &ManagePermissions($key, $udom, $uname,  
        &GetAuthType( $udom,   
      $uname));  
     $hash{$key}=$value;  
  }  
  if (untie(%hash)) {  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)  
  ." untie(GDBM) Failed ".  
  "while attempting rolesput\n";  
  }  
     } else {  
  print $client "error: ".($!+0)  
     ." tie(GDBM) Failed ".  
     "while attempting rolesput\n";  
     }  
  } else {  
     print $client "refused\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
     
     }  
 # -------------------------------------------------------------------- rolesdel  
  } elsif ($userinput =~ /^rolesdel/) {  
     if(isClient) {  
  &Debug("rolesdel");  
  if ($wasenc==1) {  
     my ($cmd,$exedom,$exeuser,$udom,$uname,$what)  
  =split(/:/,$userinput);  
     &Debug("cmd = ".$cmd." exedom= ".$exedom.  
    "user = ".$exeuser." udom=".$udom.  
    "what = ".$what);  
     my $namespace='roles';  
     chomp($what);  
     my $proname=propath($udom,$uname);  
     my $now=time;  
     {  
  my $hfh;  
  if (  
     $hfh=IO::File->new(">>$proname/$namespace.hist")  
     ) {   
     print $hfh "D:$now:$exedom:$exeuser:$what\n";  
  }  
     }  
     my @rolekeys=split(/\&/,$what);  
     my %hash;  
     if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {  
  foreach my $key (@rolekeys) {  
     delete $hash{$key};  
  }  
  if (untie(%hash)) {  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)  
  ." untie(GDBM) Failed ".  
  "while attempting rolesdel\n";  
  }  
     } else {  
  print $client "error: ".($!+0)  
     ." tie(GDBM) Failed ".  
     "while attempting rolesdel\n";  
     }  
  } else {  
     print $client "refused\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
         
     }  
 # ------------------------------------------------------------------------- get  
  } elsif ($userinput =~ /^get/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$what)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  chomp($what);  
  my @queries=split(/\&/,$what);  
  my $proname=propath($udom,$uname);  
  my $qresult='';  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {  
     for (my $i=0;$i<=$#queries;$i++) {  
  $qresult.="$hash{$queries[$i]}&";  
     }  
     if (untie(%hash)) {  
  $qresult=~s/\&$//;  
  print $client "$qresult\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting get\n";  
     }  
  } else {  
     if ($!+0 == 2) {  
  print $client "error:No such file or ".  
     "GDBM reported bad block error\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." tie(GDBM) Failed ".  
     "while attempting get\n";  
     }  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ------------------------------------------------------------------------ eget  
  } elsif ($userinput =~ /^eget/) {  
     if (isClient) {  
  my ($cmd,$udom,$uname,$namespace,$what)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  chomp($what);  
  my @queries=split(/\&/,$what);  
  my $proname=propath($udom,$uname);  
  my $qresult='';  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {  
     for (my $i=0;$i<=$#queries;$i++) {  
  $qresult.="$hash{$queries[$i]}&";  
     }  
     if (untie(%hash)) {  
  $qresult=~s/\&$//;  
  if ($cipher) {  
     my $cmdlength=length($qresult);  
     $qresult.="         ";  
     my $encqresult='';  
     for   
  (my $encidx=0;$encidx<=$cmdlength;$encidx+=8) {  
     $encqresult.=  
  unpack("H16",  
        $cipher->encrypt(substr($qresult,$encidx,8)));  
  }  
     print $client "enc:$cmdlength:$encqresult\n";  
  } else {  
     print $client "error:no_key\n";  
  }  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting eget\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting eget\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
       
     }  
 # ------------------------------------------------------------------------- del  
  } elsif ($userinput =~ /^del/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$what)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  chomp($what);  
  my $proname=propath($udom,$uname);  
  my $now=time;  
  unless ($namespace=~/^nohist\_/) {  
     my $hfh;  
     if (  
  $hfh=IO::File->new(">>$proname/$namespace.hist")  
  ) { print $hfh "D:$now:$what\n"; }  
  }  
  my @keys=split(/\&/,$what);  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {  
     foreach my $key (@keys) {  
  delete($hash{$key});  
     }  
     if (untie(%hash)) {  
  print $client "ok\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting del\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting del\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
   
     }  
 # ------------------------------------------------------------------------ keys  
  } elsif ($userinput =~ /^keys/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  my $proname=propath($udom,$uname);  
  my $qresult='';  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {  
     foreach my $key (keys %hash) {  
  $qresult.="$key&";  
     }  
     if (untie(%hash)) {  
  $qresult=~s/\&$//;  
  print $client "$qresult\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting keys\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting keys\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
      
     }  
 # ----------------------------------------------------------------- dumpcurrent  
  } elsif ($userinput =~ /^currentdump/) {  
     if (isClient) {  
  my ($cmd,$udom,$uname,$namespace)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  my $qresult='';  
  my $proname=propath($udom,$uname);  
  my %hash;  
  if (tie(%hash,'GDBM_File',  
  "$proname/$namespace.db",  
  &GDBM_READER(),0640)) {  
     # Structure of %data:  
     # $data{$symb}->{$parameter}=$value;  
     # $data{$symb}->{'v.'.$parameter}=$version;  
     # since $parameter will be unescaped, we do not  
     # have to worry about silly parameter names...  
     my %data = ();  
     while (my ($key,$value) = each(%hash)) {  
  my ($v,$symb,$param) = split(/:/,$key);  
  next if ($v eq 'version' || $symb eq 'keys');  
  next if (exists($data{$symb}) &&   
  exists($data{$symb}->{$param}) &&  
  $data{$symb}->{'v.'.$param} > $v);  
  $data{$symb}->{$param}=$value;  
  $data{$symb}->{'v.'.$param}=$v;  
     }  
     if (untie(%hash)) {  
  while (my ($symb,$param_hash) = each(%data)) {  
     while(my ($param,$value) = each (%$param_hash)){  
  next if ($param =~ /^v\./);  
  $qresult.=$symb.':'.$param.'='.$value.'&';  
     }  
  }  
  chop($qresult);  
  print $client "$qresult\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting currentdump\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting currentdump\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
     }  
 # ------------------------------------------------------------------------ dump  
  } elsif ($userinput =~ /^dump/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$regexp)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  if (defined($regexp)) {  
     $regexp=&unescape($regexp);  
  } else {  
     $regexp='.';  
  }  
  my $qresult='';  
  my $proname=propath($udom,$uname);  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {  
        while (my ($key,$value) = each(%hash)) {  
    if ($regexp eq '.') {  
        $qresult.=$key.'='.$value.'&';  
    } else {  
        my $unescapeKey = &unescape($key);  
        if (eval('$unescapeKey=~/$regexp/')) {  
    $qresult.="$key=$value&";  
        }  
    }  
        }  
        if (untie(%hash)) {  
    chop($qresult);  
    print $client "$qresult\n";  
        } else {  
    print $client "error: ".($!+0)  
        ." untie(GDBM) Failed ".  
                                        "while attempting dump\n";  
        }  
    } else {  
        print $client "error: ".($!+0)  
    ." tie(GDBM) Failed ".  
    "while attempting dump\n";  
    }  
     } else {  
  Reply($client, "refused\n", $userinput);  
     
     }  
 # ----------------------------------------------------------------------- store  
  } elsif ($userinput =~ /^store/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$rid,$what)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  if ($namespace ne 'roles') {  
     chomp($what);  
     my $proname=propath($udom,$uname);  
     my $now=time;  
     unless ($namespace=~/^nohist\_/) {  
  my $hfh;  
  if (  
     $hfh=IO::File->new(">>$proname/$namespace.hist")  
     ) { print $hfh "P:$now:$rid:$what\n"; }  
     }  
     my @pairs=split(/\&/,$what);  
     my %hash;  
     if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_WRCREAT(),0640)) {  
  my @previouskeys=split(/&/,$hash{"keys:$rid"});  
  my $key;  
  $hash{"version:$rid"}++;  
  my $version=$hash{"version:$rid"};  
  my $allkeys='';   
  foreach my $pair (@pairs) {  
     my ($key,$value)=split(/=/,$pair);  
     $allkeys.=$key.':';  
     $hash{"$version:$rid:$key"}=$value;  
  }  
  $hash{"$version:$rid:timestamp"}=$now;  
  $allkeys.='timestamp';  
  $hash{"$version:keys:$rid"}=$allkeys;  
  if (untie(%hash)) {  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)  
  ." untie(GDBM) Failed ".  
  "while attempting store\n";  
  }  
     } else {  
  print $client "error: ".($!+0)  
     ." tie(GDBM) Failed ".  
     "while attempting store\n";  
     }  
  } else {  
     print $client "refused\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
        
     }  
 # --------------------------------------------------------------------- restore  
  } elsif ($userinput =~ /^restore/) {  
     if(isClient) {  
  my ($cmd,$udom,$uname,$namespace,$rid)  
     =split(/:/,$userinput);  
  $namespace=~s/\//\_/g;  
  $namespace=~s/\W//g;  
  chomp($rid);  
  my $proname=propath($udom,$uname);  
  my $qresult='';  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname/$namespace.db",&GDBM_READER(),0640)) {  
     my $version=$hash{"version:$rid"};  
     $qresult.="version=$version&";  
     my $scope;  
     for ($scope=1;$scope<=$version;$scope++) {  
  my $vkeys=$hash{"$scope:keys:$rid"};  
  my @keys=split(/:/,$vkeys);  
  my $key;  
  $qresult.="$scope:keys=$vkeys&";  
  foreach $key (@keys) {  
     $qresult.="$scope:$key=".$hash{"$scope:$rid:$key"}."&";  
  }                                    
     }  
     if (untie(%hash)) {  
  $qresult=~s/\&$//;  
  print $client "$qresult\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting restore\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting restore\n";  
  }  
     } else  {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # -------------------------------------------------------------------- chatsend  
  } elsif ($userinput =~ /^chatsend/) {  
     if(isClient) {  
  my ($cmd,$cdom,$cnum,$newpost)=split(/\:/,$userinput);  
  &chatadd($cdom,$cnum,$newpost);  
  print $client "ok\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
         
     }  
 # -------------------------------------------------------------------- chatretr  
  } elsif ($userinput =~ /^chatretr/) {  
     if(isClient) {  
  my   
     ($cmd,$cdom,$cnum,$udom,$uname)=split(/\:/,$userinput);  
  my $reply='';  
  foreach (&getchat($cdom,$cnum,$udom,$uname)) {  
     $reply.=&escape($_).':';  
  }  
  $reply=~s/\:$//;  
  print $client $reply."\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ------------------------------------------------------------------- querysend  
  } elsif ($userinput =~ /^querysend/) {  
     if(isClient) {  
  my ($cmd,$query,  
     $arg1,$arg2,$arg3)=split(/\:/,$userinput);  
  $query=~s/\n*$//g;  
  print $client "".  
     sqlreply("$clientname\&$query".  
      "\&$arg1"."\&$arg2"."\&$arg3")."\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
         
     }  
 # ------------------------------------------------------------------ queryreply  
  } elsif ($userinput =~ /^queryreply/) {  
     if(isClient) {  
  my ($cmd,$id,$reply)=split(/:/,$userinput);   
  my $store;  
  my $execdir=$perlvar{'lonDaemons'};  
  if ($store=IO::File->new(">$execdir/tmp/$id")) {  
     $reply=~s/\&/\n/g;  
     print $store $reply;  
     close $store;  
     my $store2=IO::File->new(">$execdir/tmp/$id.end");  
     print $store2 "done\n";  
     close $store2;  
     print $client "ok\n";  
  }  
  else {  
     print $client "error: ".($!+0)  
  ." IO::File->new Failed ".  
  "while attempting queryreply\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
        
     }  
 # ----------------------------------------------------------------- courseidput  
  } elsif ($userinput =~ /^courseidput/) {  
     if(isClient) {  
  my ($cmd,$udom,$what)=split(/:/,$userinput);  
  chomp($what);  
  $udom=~s/\W//g;  
  my $proname=  
     "$perlvar{'lonUsersDir'}/$udom/nohist_courseids";  
  my $now=time;  
  my @pairs=split(/\&/,$what);  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_WRCREAT(),0640)) {  
     foreach my $pair (@pairs) {  
  my ($key,$value)=split(/=/,$pair);  
  $hash{$key}=$value.':'.$now;  
     }  
     if (untie(%hash)) {  
  print $client "ok\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting courseidput\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting courseidput\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ---------------------------------------------------------------- courseiddump  
  } elsif ($userinput =~ /^courseiddump/) {  
     if(isClient) {  
  my ($cmd,$udom,$since,$description)  
     =split(/:/,$userinput);  
  if (defined($description)) {  
     $description=&unescape($description);  
  } else {  
     $description='.';  
  }  
  unless (defined($since)) { $since=0; }  
  my $qresult='';  
  my $proname=  
     "$perlvar{'lonUsersDir'}/$udom/nohist_courseids";  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_READER(),0640)) {  
     while (my ($key,$value) = each(%hash)) {  
  my ($descr,$lasttime)=split(/\:/,$value);  
  if ($lasttime<$since) { next; }  
  if ($description eq '.') {  
     $qresult.=$key.'='.$descr.'&';  
  } else {  
     my $unescapeVal = &unescape($descr);  
     if (eval('$unescapeVal=~/\Q$description\E/i')) {  
  $qresult.="$key=$descr&";  
     }  
  }  
     }  
     if (untie(%hash)) {  
  chop($qresult);  
  print $client "$qresult\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting courseiddump\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting courseiddump\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ----------------------------------------------------------------------- idput  
  } elsif ($userinput =~ /^idput/) {  
     if(isClient) {  
  my ($cmd,$udom,$what)=split(/:/,$userinput);  
  chomp($what);  
  $udom=~s/\W//g;  
  my $proname="$perlvar{'lonUsersDir'}/$udom/ids";  
  my $now=time;  
  {  
     my $hfh;  
     if (  
  $hfh=IO::File->new(">>$proname.hist")  
  ) { print $hfh "P:$now:$what\n"; }  
  }  
  my @pairs=split(/\&/,$what);  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_WRCREAT(),0640)) {  
     foreach my $pair (@pairs) {  
  my ($key,$value)=split(/=/,$pair);  
  $hash{$key}=$value;  
     }  
     if (untie(%hash)) {  
  print $client "ok\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting idput\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting idput\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ----------------------------------------------------------------------- idget  
  } elsif ($userinput =~ /^idget/) {  
     if(isClient) {  
  my ($cmd,$udom,$what)=split(/:/,$userinput);  
  chomp($what);  
  $udom=~s/\W//g;  
  my $proname="$perlvar{'lonUsersDir'}/$udom/ids";  
  my @queries=split(/\&/,$what);  
  my $qresult='';  
  my %hash;  
  if (tie(%hash,'GDBM_File',"$proname.db",&GDBM_READER(),0640)) {  
     for (my $i=0;$i<=$#queries;$i++) {  
  $qresult.="$hash{$queries[$i]}&";  
     }  
     if (untie(%hash)) {  
  $qresult=~s/\&$//;  
  print $client "$qresult\n";  
     } else {  
  print $client "error: ".($!+0)  
     ." untie(GDBM) Failed ".  
     "while attempting idget\n";  
     }  
  } else {  
     print $client "error: ".($!+0)  
  ." tie(GDBM) Failed ".  
  "while attempting idget\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ---------------------------------------------------------------------- tmpput  
  } elsif ($userinput =~ /^tmpput/) {  
     if(isClient) {  
  my ($cmd,$what)=split(/:/,$userinput);  
  my $store;  
  $tmpsnum++;  
  my $id=$$.'_'.$clientip.'_'.$tmpsnum;  
  $id=~s/\W/\_/g;  
  $what=~s/\n//g;  
  my $execdir=$perlvar{'lonDaemons'};  
  if ($store=IO::File->new(">$execdir/tmp/$id.tmp")) {  
     print $store $what;  
     close $store;  
     print $client "$id\n";  
  }  
  else {  
     print $client "error: ".($!+0)  
  ."IO::File->new Failed ".  
  "while attempting tmpput\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
       
     }  
       
 # ---------------------------------------------------------------------- tmpget  
  } elsif ($userinput =~ /^tmpget/) {  
     if(isClient) {  
  my ($cmd,$id)=split(/:/,$userinput);  
  chomp($id);  
  $id=~s/\W/\_/g;  
  my $store;  
  my $execdir=$perlvar{'lonDaemons'};  
  if ($store=IO::File->new("$execdir/tmp/$id.tmp")) {  
     my $reply=<$store>;  
     print $client "$reply\n";  
     close $store;  
  }  
  else {  
     print $client "error: ".($!+0)  
  ."IO::File->new Failed ".  
  "while attempting tmpget\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
         
     }  
 # ---------------------------------------------------------------------- tmpdel  
  } elsif ($userinput =~ /^tmpdel/) {  
     if(isClient) {  
  my ($cmd,$id)=split(/:/,$userinput);  
  chomp($id);  
  $id=~s/\W/\_/g;  
  my $execdir=$perlvar{'lonDaemons'};  
  if (unlink("$execdir/tmp/$id.tmp")) {  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)  
  ."Unlink tmp Failed ".  
  "while attempting tmpdel\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
        
     }  
 # -------------------------------------------------------------------------- ls  
  } elsif ($userinput =~ /^ls/) {  
     if(isClient) {  
  my $obs;  
  my $rights;  
  my ($cmd,$ulsdir)=split(/:/,$userinput);  
  my $ulsout='';  
  my $ulsfn;  
  if (-e $ulsdir) {  
     if(-d $ulsdir) {  
  if (opendir(LSDIR,$ulsdir)) {  
     while ($ulsfn=readdir(LSDIR)) {  
  undef $obs, $rights;   
  my @ulsstats=stat($ulsdir.'/'.$ulsfn);  
  #We do some obsolete checking here  
  if(-e $ulsdir.'/'.$ulsfn.".meta") {   
     open(FILE, $ulsdir.'/'.$ulsfn.".meta");  
     my @obsolete=<FILE>;  
     foreach my $obsolete (@obsolete) {  
         if($obsolete =~ m|(<obsolete>)(on)|) { $obs = 1; }   
  if($obsolete =~ m|(<copyright>)(default)|) { $rights = 1; }  
     }  
  }  
  $ulsout.=$ulsfn.'&'.join('&',@ulsstats);  
  if($obs eq '1') { $ulsout.="&1"; }  
  else { $ulsout.="&0"; }  
  if($rights eq '1') { $ulsout.="&1:"; }  
  else { $ulsout.="&0:"; }  
     }  
     closedir(LSDIR);  
  }  
     } else {  
  my @ulsstats=stat($ulsdir);  
  $ulsout.=$ulsfn.'&'.join('&',@ulsstats).':';  
     }  
  } else {  
     $ulsout='no_such_dir';  
  }  
  if ($ulsout eq '') { $ulsout='empty'; }  
  print $client "$ulsout\n";  
     } else {  
  Reply($client, "refused\n", $userinput);  
        
     }  
 # ----------------------------------------------------------------- setannounce  
  } elsif ($userinput =~ /^setannounce/) {  
     if (isClient) {  
  my ($cmd,$announcement)=split(/:/,$userinput);  
  chomp($announcement);  
  $announcement=&unescape($announcement);  
  if (my $store=IO::File->new('>'.$perlvar{'lonDocRoot'}.  
     '/announcement.txt')) {  
     print $store $announcement;  
     close $store;  
     print $client "ok\n";  
  } else {  
     print $client "error: ".($!+0)."\n";  
  }  
     } else {  
  Reply($client, "refused\n", $userinput);  
          
     }  
 # ------------------------------------------------------------------ Hanging up  
  } elsif (($userinput =~ /^exit/) ||  
  ($userinput =~ /^init/)) { # no restrictions.  
     &logthis(  
      "Client $clientip ($clientname) hanging up: $userinput");  
     print $client "bye\n";  
     $client->shutdown(2);        # shutdown the socket forcibly.  
     $client->close();  
     last;  
   
 # ---------------------------------- set current host/domain  
  } elsif ($userinput =~ /^sethost:/) {  
     if (isClient) {  
  print $client &sethost($userinput)."\n";  
     } else {  
  print $client "refused\n";  
     }  
 #---------------------------------- request file (?) version.  
  } elsif ($userinput =~/^version:/) {  
     if (isClient) {  
  print $client &version($userinput)."\n";  
     } else {  
  print $client "refused\n";  
     }  
 # ------------------------------------------------------------- unknown command  
   
  } else {  
     # unknown command  
     print $client "unknown_cmd\n";  
  }  
 # -------------------------------------------------------------------- complete  
  alarm(0);   alarm(0);
  &status('Listening to '.$clientname);   &status('Listening to '.$clientname." ($keymode)");   
     }      }
   
 # --------------------------------------------- client unknown or fishy, refuse  # --------------------------------------------- client unknown or fishy, refuse
  } else {   }  else {
     print $client "refused\n";      print $client "refused\n";
     $client->close();      $client->close();
     &logthis("<font color='blue'>WARNING: "      &logthis("<font color='blue'>WARNING: "
      ."Rejected client $clientip, closing connection</font>");       ."Rejected client $clientip, closing connection</font>");
  }   }
     }                   }            
           
 # =============================================================================  # =============================================================================
           
Line 2910  sub make_new_child { Line 3646  sub make_new_child {
 #  #
 sub ManagePermissions  sub ManagePermissions
 {  {
     my $request = shift;  
     my $domain  = shift;      my ($request, $domain, $user, $authtype) = @_;
     my $user    = shift;  
     my $authtype= shift;  
   
     # See if the request is of the form /$domain/_au      # See if the request is of the form /$domain/_au
     if($request =~ /^(\/$domain\/_au)$/) { # It's an author rolesput...      if($request =~ /^(\/$domain\/_au)$/) { # It's an author rolesput...
Line 2930  sub ManagePermissions Line 3664  sub ManagePermissions
 #  #
 sub GetAuthType   sub GetAuthType 
 {  {
     my $domain = shift;  
     my $user   = shift;      my ($domain, $user)  = @_;
   
     Debug("GetAuthType( $domain, $user ) \n");      Debug("GetAuthType( $domain, $user ) \n");
     my $proname    = &propath($domain, $user);       my $proname    = &propath($domain, $user); 
Line 3233  sub sethost { Line 3967  sub sethost {
     my (undef,$hostid)=split(/:/,$remotereq);      my (undef,$hostid)=split(/:/,$remotereq);
     if (!defined($hostid)) { $hostid=$perlvar{'lonHostID'}; }      if (!defined($hostid)) { $hostid=$perlvar{'lonHostID'}; }
     if ($hostip{$perlvar{'lonHostID'}} eq $hostip{$hostid}) {      if ($hostip{$perlvar{'lonHostID'}} eq $hostip{$hostid}) {
  $currenthostid=$hostid;   $currenthostid  =$hostid;
  $currentdomainid=$hostdom{$hostid};   $currentdomainid=$hostdom{$hostid};
  &logthis("Setting hostid to $hostid, and domain to $currentdomainid");   &logthis("Setting hostid to $hostid, and domain to $currentdomainid");
     } else {      } else {
Line 3273  sub userload { Line 4007  sub userload {
     return $userloadpercent;      return $userloadpercent;
 }  }
   
   # Routines for serializing arrays and hashes (copies from lonnet)
   
   sub array2str {
     my (@array) = @_;
     my $result=&arrayref2str(\@array);
     $result=~s/^__ARRAY_REF__//;
     $result=~s/__END_ARRAY_REF__$//;
     return $result;
   }
                                                                                    
   sub arrayref2str {
     my ($arrayref) = @_;
     my $result='__ARRAY_REF__';
     foreach my $elem (@$arrayref) {
       if(ref($elem) eq 'ARRAY') {
         $result.=&arrayref2str($elem).'&';
       } elsif(ref($elem) eq 'HASH') {
         $result.=&hashref2str($elem).'&';
       } elsif(ref($elem)) {
         #print("Got a ref of ".(ref($elem))." skipping.");
       } else {
         $result.=&escape($elem).'&';
       }
     }
     $result=~s/\&$//;
     $result .= '__END_ARRAY_REF__';
     return $result;
   }
                                                                                    
   sub hash2str {
     my (%hash) = @_;
     my $result=&hashref2str(\%hash);
     $result=~s/^__HASH_REF__//;
     $result=~s/__END_HASH_REF__$//;
     return $result;
   }
                                                                                    
   sub hashref2str {
     my ($hashref)=@_;
     my $result='__HASH_REF__';
     foreach (sort(keys(%$hashref))) {
       if (ref($_) eq 'ARRAY') {
         $result.=&arrayref2str($_).'=';
       } elsif (ref($_) eq 'HASH') {
         $result.=&hashref2str($_).'=';
       } elsif (ref($_)) {
         $result.='=';
         #print("Got a ref of ".(ref($_))." skipping.");
       } else {
           if ($_) {$result.=&escape($_).'=';} else { last; }
       }
   
       if(ref($hashref->{$_}) eq 'ARRAY') {
         $result.=&arrayref2str($hashref->{$_}).'&';
       } elsif(ref($hashref->{$_}) eq 'HASH') {
         $result.=&hashref2str($hashref->{$_}).'&';
       } elsif(ref($hashref->{$_})) {
          $result.='&';
         #print("Got a ref of ".(ref($hashref->{$_}))." skipping.");
       } else {
         $result.=&escape($hashref->{$_}).'&';
       }
     }
     $result=~s/\&$//;
     $result .= '__END_HASH_REF__';
     return $result;
   }
   
 # ----------------------------------- POD (plain old documentation, CPAN style)  # ----------------------------------- POD (plain old documentation, CPAN style)
   
 =head1 NAME  =head1 NAME

Removed from v.1.190  
changed lines
  Added in v.1.214


FreeBSD-CVSweb <freebsd-cvsweb@FreeBSD.org>