Authz refactoring

Merge from branches/authz-dev

Basically here is a list of what has been done:
- Convert all of the authz modules from hook based to provider based
- Remove the ap_requires field from the core_dir_config structure
- Remove the function ap_requires() since its functionality is no
longer supported or necessary in the refactoring
- Remove the calls to ap_some_auth_required() in the core request
handling to allow the  hooks to be called in all cases.
- Add the new module mod_authz_core which will act as the authorization
provider vector and contain common authz directives such as 'Require',
'Reject' and  '<RequireAlias>'
- Add the new module mod_authn_core which will contain common
authentication directives such as 'AuthType', 'AuthName' and
'<AuthnProviderAlias>'
- Move the check for METHOD_MASK out of the authz providers and into
the authz_core provider vector
- Define the status codes that can be returned by the authz providers
as AUTHZ_DENIED,  AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR   
- Remove the 'Satisfy' directive 
- Implement the '<RequireAll>', '<RequireOne>' block directives  to
handle the 'and' and 'or' logic for authorization.
- Remove the 'AuthzXXXAuthoritative' directives from all of the authz
providers
- Implement the 'Reject' directive that will deny authorization if the
argument is true
- Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>'
logic
- Reimplement the host based authorization functionality provided by 
'allow', 'deny' and 'order' as authz providers   
- Remove the 'allow', 'deny' and 'order' directives      
- Merge mod_authn_alias into mod_authn_core
- Add '<RequireAlias>' functionality which is similar to
'<AuthnProviderAlias>' but specific to authorization aliasing
- Remove all of the references to the 'authzxxxAuthoritative'
directives from the documentation
- Remove the 'Satisfy' directive from the documentation
- Remove 'Allow', 'Deny', 'Order' directives from the documentation
- Document '<RequireAll>', '<RequireOne>', 'Reject' directives
- Reimplement the APIs ap_auth_type(), ap_auth_name() as optional
functions and move the  actual implementation into mod_authn_core
- Reimplement the API ap_some_auth_required() as an optional function
and move the  actual implementation into mod_authz_core

Major Changes:
- Added the directives <RequireAll>, <RequireOne>, <RequireAlias>,
Reject
- Expanded the functionality of the directive 'Require' to handle all
authorization and access control
- Added the new authz providers 'env', 'ip', 'host', 'all' to handle
host-based access control
- Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy',
'AuthzXXXAuthoritative'
- Removed the ap_require() API
- Moved the directives 'AuthType', 'AuthName' out of mod_core and into
mod_authn_core
- Moved the directive 'Require' out of mod_core and into
mod_authz_core
- Merged mod_authn_alias into mod_authn_core
- Renamed mod_authz_dbm authz providers from 'group' and 'file-group'
to 'dbm-group' and 'dbm-file-group'

Benefits:
- All authorization and access control is now handle through two
directives, 'Require' and 'Reject'
- Authorization has been expanded to allow for complex 'AND/OR' control
logic through the directives '<RequireAll>' and '<RequireOne>'
- Configuration is now much simpler and consistent across the board
- Other modules like mod_ssl and mod_proxy should be able to plug into
and take advantage of  the same provider based authorization mechanism
by implementing their own providers

Issues:
- Backwards compatibility between 2.2 and 2.3 configurations will be
broken in the area  of authorization and access control due to the fact
that the directives 'allow', 'deny',  'order' and 'satisfy' have been
removed.  When moving from 2.2 to 2.3 these directives  will have to be
changed to 'Require all granted', 'Require all denied' or some variation
 of the authz host-based providers.
- Existing third party authorization modules will have to adapt to the
new structure.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368027 13f79535-47bb-0310-9956-ffa450edef68

1 files changed, 9 insertions, 33 deletions

diff --git a/include/http_core.h b/include/http_core.h
index 62f9e95e40..44f2410a14 100644
--- a/include/http_core.h
+++ b/include/http_core.h
@@ -114,13 +114,6 @@ extern "C" {
 
 /** @} // get_remote_host */
 
-/** all of the requirements must be met */
-#define SATISFY_ALL 0
-/**  any of the requirements must be met */
-#define SATISFY_ANY 1
-/** There are no applicable satisfy lines */
-#define SATISFY_NOSPEC 2
-
 /** Make sure we don't write less than 8000 bytes at any one time.
  */
 #define AP_MIN_BYTES_TO_WRITE  8000
@@ -294,25 +287,6 @@ AP_DECLARE(const char *) ap_auth_type(request_rec *r);
  */
 AP_DECLARE(const char *) ap_auth_name(request_rec *r);     
 
-/**
- * How the requires lines must be met.
- * @param r The current request
- * @return How the requirements must be met.  One of:
- * <pre>
- *      SATISFY_ANY    -- any of the requirements must be met.
- *      SATISFY_ALL    -- all of the requirements must be met.
- *      SATISFY_NOSPEC -- There are no applicable satisfy lines
- * </pre>
- */
-AP_DECLARE(int) ap_satisfies(request_rec *r);
-
-/**
- * Retrieve information about all of the requires directives for this request
- * @param r The current request
- * @return An array of all requires directives for this request
- */
-AP_DECLARE(const apr_array_header_t *) ap_requires(request_rec *r);    
-
 #ifdef CORE_PRIVATE
 
 /**
@@ -451,13 +425,6 @@ typedef struct {
     
     char *ap_default_type;
   
-    /* Authentication stuff.  Groan... */
-    
-    int *satisfy; /* for every method one */
-    char *ap_auth_type;
-    char *ap_auth_name;
-    apr_array_header_t *ap_requires;
-
     /* Custom response config. These can contain text or a URL to redirect to.
      * if response_code_strings is NULL then there are none in the config,
      * if it's not null then it's allocated to sizeof(char*)*RESPONSE_CODES.
@@ -680,6 +647,15 @@ APR_DECLARE_OPTIONAL_FN(void, ap_logio_add_bytes_out,
 APR_DECLARE_OPTIONAL_FN(const char *, ap_ident_lookup,
                         (request_rec *r));
 
+/* ----------------------------------------------------------------------
+ *
+ * authorization values with mod_authz_host
+ */
+
+APR_DECLARE_OPTIONAL_FN(int, authz_some_auth_required, (request_rec *r));
+APR_DECLARE_OPTIONAL_FN(const char *, authn_ap_auth_type, (request_rec *r));
+APR_DECLARE_OPTIONAL_FN(const char *, authn_ap_auth_name, (request_rec *r));
+
 /* ---------------------------------------------------------------------- */
 
 #ifdef __cplusplus