summaryrefslogtreecommitdiffstats
path: root/modules/aaa/mod_authz_host.c (follow)
Commit message (Collapse)AuthorAgeFilesLines
* * modules/aaa/mod_authz_host.c (host_check_authorization): SimplifyJoe Orton2018-03-081-14/+22
| | | | | | | | | comment stripping in "Require host"; log a warning if a comment is used in 'Require host', or an error if the expression is empty with the comment stripped. (Currently in 2.4, #comment part is parsed) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1826207 13f79535-47bb-0310-9956-ffa450edef68
* PR59612: Print the ap_expr() error message when an expression cannotEric Covener2016-05-221-0/+1
| | | | | | | | | | | be evaluated in forward-dns provider. Submitted By: Tianyin Xu <tixu cs.ucsd.edu> Committed By: covener git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1745034 13f79535-47bb-0310-9956-ffa450edef68
* mod_authz_host: add a new "forward-dns" authorization typeFabien Coelho2016-03-101-0/+75
| | | | | | | This new type does not rely on reverse DNS lookups. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1734412 13f79535-47bb-0310-9956-ffa450edef68
* hostname: Test and log useragent_host per-request across various modules,William A. Rowe Jr2016-02-121-4/+1
| | | | | | | | | | | | | including the scoreboard, expression and rewrite engines, setenvif, authz_host, access_compat, custom logging, ssl and REMOTE_HOST variables. PR55348 [William Rowe] This is the complete change set which applies cleanly to 2.4.x as well, the server/scoreboard.c will follow, which does not apply due to drift. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1729930 13f79535-47bb-0310-9956-ffa450edef68
* * mod_access_compat, mod_authz_host: Handle '#' character.Jan Kaluža2015-03-191-1/+14
| | | | | | | | | | For mod_access_compat, disable '#' in hostname completely. For mod_authz_host, treat '#' as a comment and ignore everything after that. This allows better handling of admin errors like 'Require host localhost# Add example.com later'. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1667676 13f79535-47bb-0310-9956-ffa450edef68
* follow-up to r1554161, r1554168, r1554170, r1554175, r1554188, and r1554195:Jeff Trawick2014-01-151-1/+1
| | | | | | | axe unnecessary initialization/pool allocation git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1558483 13f79535-47bb-0310-9956-ffa450edef68
* mod_authnz_host: Support the expression parser within the require directives.Graham Leggett2013-12-301-2/+33
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1554188 13f79535-47bb-0310-9956-ffa450edef68
* Use apr_psprintf(... "%pm"...) instead of explicit call to apr_strerrorChristophe Jaillet2013-04-021-4/+2
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1463754 13f79535-47bb-0310-9956-ffa450edef68
* Further clarify the naming of the entity that originates the request byGraham Leggett2011-12-141-4/+4
| | | | | | | calling that entity a useragent instead of a client. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1214003 13f79535-47bb-0310-9956-ffa450edef68
* Add lots of unique tags to error log messagesStefan Fritsch2011-12-031-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1209766 13f79535-47bb-0310-9956-ffa450edef68
* Introduce a per connection "peer_ip" and a per request "client_ip" toGraham Leggett2011-11-251-4/+4
| | | | | | | | distinguish between the raw IP address of the connection and the effective IP address of the request. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1206291 13f79535-47bb-0310-9956-ffa450edef68
* Introduce a per request version of the remote IP address, which can beGraham Leggett2011-11-221-4/+4
| | | | | | | | optionally modified by a module when the effective IP of the client is not the same as the real IP of the client (such as a load balancer). git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1204968 13f79535-47bb-0310-9956-ffa450edef68
* Cleanup effort in prep for GA push:Jim Jagielski2011-09-231-1/+1
| | | | | | | | Trim trailing whitespace... no func change git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1174751 13f79535-47bb-0310-9956-ffa450edef68
* PR46214: axe some misleading DEBUG messages in mod_authz_host. Eric Covener2011-08-071-12/+4
| | | | | | | | | | | | Access is not necessarily denied because a single requirement failed to grant access, and mod_authz_core is already reporting at DEBUG the require line and the providers result. Elaborate on one remaining legitimate message to include the require line. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1154706 13f79535-47bb-0310-9956-ffa450edef68
* don't use data allocated from ptemp when parsing .htaccessStefan Fritsch2010-09-251-3/+15
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1001284 13f79535-47bb-0310-9956-ffa450edef68
* in 'ip' authz provider, parse subnets only once on startup instead of once perStefan Fritsch2010-09-251-45/+79
| | | | | | | request git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1001234 13f79535-47bb-0310-9956-ffa450edef68
* Add 'local' authz provider that matches connections originatingStefan Fritsch2010-09-251-21/+47
| | | | | | | | | on the local host. PR 19938. Also remove some cruft from mod_authz_host (we don't need a per-dir config) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1001207 13f79535-47bb-0310-9956-ffa450edef68
* Move all, env, and method authz providers from mod_authz_host to mod_authz_coreStefan Fritsch2010-09-251-114/+0
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1001200 13f79535-47bb-0310-9956-ffa450edef68
* Add method authz provider as potential Limit/LimitExcept replacement.Stefan Fritsch2010-09-191-0/+41
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@998708 13f79535-47bb-0310-9956-ffa450edef68
* Allow authz providers to check args while reading the config and allowStefan Fritsch2010-09-191-10/+39
| | | | | | | | | them to cache parsed args. Use this to check that argument to 'all' provider is 'granted' or 'denied'. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@998706 13f79535-47bb-0310-9956-ffa450edef68
* The approach for allowing authorization by user or IP introduced in r956387,Stefan Fritsch2010-07-141-3/+3
| | | | | | | | | | | | | | | | | | | | | etc. causes problems because the authentication module calls note_*_auth_failure if authentication fails. This is inappropriate if access is later allowed because of the IP. So, instead of calling the auth_checker hook even if authentication failed, we introduce a new access_checker_ex hook that runs between the access_checker and the check_user_id hooks. If an access_checker_ex functions returns OK, the request will be allowed without authentication. To make use of this, change mod_authz_core to walk the require blocks in the access_checker_ex phase and deny/allow the request if the authz result does not depend on an authenticated user. To distinguish a real AUTHZ_DENIED from an authz provider from an authz provider needing an authenticated user, the latter must return the new AUTHZ_DENIED_NO_USER code. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@964156 13f79535-47bb-0310-9956-ffa450edef68
* Use the new APLOG_USE_MODULE/AP_DECLARE_MODULE macros everywhere to takeStefan Fritsch2010-06-061-1/+1
| | | | | | | advantage of per-module loglevels git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@951895 13f79535-47bb-0310-9956-ffa450edef68
* Convert common provider version strings ("0") toChris Darroch2008-05-201-4/+8
| | | | | | | AUTHN/Z_PROVIDER_VERSION macros defined in mod_auth.h. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@658046 13f79535-47bb-0310-9956-ffa450edef68
* Avoid calling access control hooks for internal requests withChris Darroch2008-04-031-8/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | configurations which match those of the initial request. Revert to the original behaviour (call access control hooks for internal requests with URIs different from the initial request) if any access control hooks or providers are not registered as permitting this optimization. Introduce wrappers for access control hook and provider registration which can accept additional mode and flag data. The configuration walk optimizations were originally proposed a while ago (see http://marc.info/?l=apache-httpd-dev&m=116536713506234&w=2); they have been used since then in production systems and appear to be stable and effective. They permit certain combinations of modules and clients to function efficiently, especially when a deeply recursive series of internal requests, such as those generated by certain WebDAV requests, are all subject to the identical authentication and authorization directives. The major change from the original proposal is a cleaner mechanism for detecting modules which may expect the old behaviour. This has been tested successfully with Subversion's mod_authz_svn, which specifically requires the old behaviour when performing path-based authorization based against its own private access control configuration files. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@644525 13f79535-47bb-0310-9956-ffa450edef68
* detabifyJim Jagielski2007-08-061-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@563244 13f79535-47bb-0310-9956-ffa450edef68
* update license header textRoy T. Fielding2006-07-111-6/+6
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@420983 13f79535-47bb-0310-9956-ffa450edef68
* Update the copyright year in all .c, .h and .xml filesColm MacCarthaigh2006-04-191-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@395228 13f79535-47bb-0310-9956-ffa450edef68
* Remove the call to ap_note_auth_failure() from the providers. ↵Bradley Nicholes2006-01-181-3/+0
| | | | | | mod_authz_core will make the call if it is necessary. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@370039 13f79535-47bb-0310-9956-ffa450edef68
* Authz refactoringBradley Nicholes2006-01-111-197/+141
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Merge from branches/authz-dev Basically here is a list of what has been done: - Convert all of the authz modules from hook based to provider based - Remove the ap_requires field from the core_dir_config structure - Remove the function ap_requires() since its functionality is no longer supported or necessary in the refactoring - Remove the calls to ap_some_auth_required() in the core request handling to allow the hooks to be called in all cases. - Add the new module mod_authz_core which will act as the authorization provider vector and contain common authz directives such as 'Require', 'Reject' and '<RequireAlias>' - Add the new module mod_authn_core which will contain common authentication directives such as 'AuthType', 'AuthName' and '<AuthnProviderAlias>' - Move the check for METHOD_MASK out of the authz providers and into the authz_core provider vector - Define the status codes that can be returned by the authz providers as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR - Remove the 'Satisfy' directive - Implement the '<RequireAll>', '<RequireOne>' block directives to handle the 'and' and 'or' logic for authorization. - Remove the 'AuthzXXXAuthoritative' directives from all of the authz providers - Implement the 'Reject' directive that will deny authorization if the argument is true - Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>' logic - Reimplement the host based authorization functionality provided by 'allow', 'deny' and 'order' as authz providers - Remove the 'allow', 'deny' and 'order' directives - Merge mod_authn_alias into mod_authn_core - Add '<RequireAlias>' functionality which is similar to '<AuthnProviderAlias>' but specific to authorization aliasing - Remove all of the references to the 'authzxxxAuthoritative' directives from the documentation - Remove the 'Satisfy' directive from the documentation - Remove 'Allow', 'Deny', 'Order' directives from the documentation - Document '<RequireAll>', '<RequireOne>', 'Reject' directives - Reimplement the APIs ap_auth_type(), ap_auth_name() as optional functions and move the actual implementation into mod_authn_core - Reimplement the API ap_some_auth_required() as an optional function and move the actual implementation into mod_authz_core Major Changes: - Added the directives <RequireAll>, <RequireOne>, <RequireAlias>, Reject - Expanded the functionality of the directive 'Require' to handle all authorization and access control - Added the new authz providers 'env', 'ip', 'host', 'all' to handle host-based access control - Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy', 'AuthzXXXAuthoritative' - Removed the ap_require() API - Moved the directives 'AuthType', 'AuthName' out of mod_core and into mod_authn_core - Moved the directive 'Require' out of mod_core and into mod_authz_core - Merged mod_authn_alias into mod_authn_core - Renamed mod_authz_dbm authz providers from 'group' and 'file-group' to 'dbm-group' and 'dbm-file-group' Benefits: - All authorization and access control is now handle through two directives, 'Require' and 'Reject' - Authorization has been expanded to allow for complex 'AND/OR' control logic through the directives '<RequireAll>' and '<RequireOne>' - Configuration is now much simpler and consistent across the board - Other modules like mod_ssl and mod_proxy should be able to plug into and take advantage of the same provider based authorization mechanism by implementing their own providers Issues: - Backwards compatibility between 2.2 and 2.3 configurations will be broken in the area of authorization and access control due to the fact that the directives 'allow', 'deny', 'order' and 'satisfy' have been removed. When moving from 2.2 to 2.3 these directives will have to be changed to 'Require all granted', 'Require all denied' or some variation of the authz host-based providers. - Existing third party authorization modules will have to adapt to the new structure. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368027 13f79535-47bb-0310-9956-ffa450edef68
* No functional Change: Removing trailing whitespace. This alsoJim Jagielski2005-11-101-3/+3
| | | | | | | | means that "blank" lines consisting of just spaces or tabs are now really blank lines git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@332306 13f79535-47bb-0310-9956-ffa450edef68
* Update copyright year to 2005 and standardize on current copyright owner line.Justin Erenkrantz2005-02-041-1/+2
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@151408 13f79535-47bb-0310-9956-ffa450edef68
* fix name of The Apache Software FoundationAndré Malo2004-02-091-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@102618 13f79535-47bb-0310-9956-ffa450edef68
* fix copyright dates according to the first check inAndré Malo2004-02-071-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@102550 13f79535-47bb-0310-9956-ffa450edef68
* apply Apache License, Version 2.0André Malo2004-02-061-53/+10
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@102525 13f79535-47bb-0310-9956-ffa450edef68
* update license to 2004.André Malo2004-01-011-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@102135 13f79535-47bb-0310-9956-ffa450edef68
* finished that boring job:André Malo2003-02-031-1/+1
| | | | | | | | | update license to 2003. Happy New Year! ;-)) git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98573 13f79535-47bb-0310-9956-ffa450edef68
* Use ap_strchr instead of strchr and get the constness right.Roy T. Fielding2003-01-171-1/+1
| | | | git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98304 13f79535-47bb-0310-9956-ffa450edef68
* not very spectacular ;-)André Malo2003-01-061-1/+2
| | | | | | | break overlong line. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98179 13f79535-47bb-0310-9956-ffa450edef68
* Stage #1 of the aaa rewrite - refactoring modules.Justin Erenkrantz2002-09-101-0/+363
All modules are reorganized under the following scheme: - mod_auth_*: Front-end (basic, digest) - mod_authn_*: Authentication (anon, dbm, default, file) - mod_authz_*: Authorization (dbm, default, groupfile, host, user) This passes the httpd-test suite when it accounts for the renaming of aaa modules. Originally written by: Dirk-Willem van Gulik Completed by: Justin Erenkrantz git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@96728 13f79535-47bb-0310-9956-ffa450edef68
generated by cgit v1.2.3 (git 2.39.1) at 2024-12-04 02:17:51 +0100