/* Licensed to the Apache Software Foundation (ASF) under one or more
 * contributor license agreements.  See the NOTICE file distributed with
 * this work for additional information regarding copyright ownership.
 * The ASF licenses this file to You under the Apache License, Version 2.0
 * (the "License"); you may not use this file except in compliance with
 * the License.  You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include "httpd.h"
#include "http_core.h"
#include "http_config.h"
#include "http_protocol.h"
#include "http_request.h"
#include "http_log.h"
#include "apr_strings.h"

/**
 * This module makes it easy to restrict what HTTP methods can be ran against
 * a server.
 *
 * It provides one command:
 *    AllowMethods
 * This command takes a list of HTTP methods to allow.
 *
 *  The most common configuration should be like this:
 *   <Directory />
 *    AllowMethods GET HEAD OPTIONS
 *   </Directory>
 *   <Directory /special/cgi-bin>
 *      AllowMethods GET HEAD OPTIONS POST
 *   </Directory>
 *  Non-matching methods will be returned a status 405 (method not allowed)
 *
 *  To allow all methods, and effectively turn off mod_allowmethods, use:
 *    AllowMethods reset
 */

typedef struct am_conf_t {
    int allowed_set;            /* AllowMethods has been set/changed flag */
    int enforce_methods;        /* Enforce AllowMethods flag              */
    ap_method_mask_t add;       /* Methods Added by +METHOD mask          */
    ap_method_mask_t remove;    /* Methods Removed by -METHOD mask        */
    ap_method_mask_t allowed;   /* Allowed Methods mask                   */
} am_conf_t;

module AP_MODULE_DECLARE_DATA allowmethods_module;

static int am_check_access(request_rec *r)
{
    int method = r->method_number;
    am_conf_t *conf;

    conf = (am_conf_t *) ap_get_module_config(r->per_dir_config,
                                              &allowmethods_module);

    if (!conf || conf->enforce_methods == 0) {
        return DECLINED;
    }

    r->allowed = conf->allowed;

    if (conf->allowed & (AP_METHOD_BIT << method)) {
        return DECLINED;
    }

    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(01623)
                  "client method denied by server configuration: '%s' to %s%s",
                  r->method,
                  r->filename ? "" : "uri ",
                  r->filename ? r->filename : r->uri);

    return HTTP_METHOD_NOT_ALLOWED;
}

static void *am_create_conf(apr_pool_t *p, char *dummy)
{
    am_conf_t *conf = apr_pcalloc(p, sizeof(am_conf_t));

    conf->allowed         = INT_MAX;
    conf->allowed_set     = 0;
    conf->add             = 0;
    conf->remove          = 0;
    conf->enforce_methods = 0;
    return conf;
}

static void *am_merge_conf(apr_pool_t *pool, void *a, void *b)
{
    am_conf_t *base = (am_conf_t *)a;
    am_conf_t *add = (am_conf_t *)b;
    am_conf_t *conf = apr_palloc(pool, sizeof(am_conf_t));

    if (add->allowed_set) {
        conf->add    = 0;
        conf->remove = 0;

        /* Add/Remove AllowedMethods set with + or - */
        if( add->add || add->remove ) {
            conf->allowed = base->allowed | add->allowed;

            if( add->add ) {
                conf->allowed |= add->add;
            }
            if( add->remove ) {
                conf->allowed &= ~(add->remove);
            }

            conf->enforce_methods = 1;
            conf->allowed_set     = 1;
        }
        /* Straightforward AllowMethods settings, just set it */
        else
        {
            conf->allowed          = add->allowed;
            conf->allowed_set      = add->allowed_set;
            conf->enforce_methods  = add->enforce_methods;
        }
    }
    else {
        conf->allowed         = base->allowed;
        conf->add             = base->add;
        conf->remove          = base->remove;
        conf->allowed_set     = base->allowed_set;
        conf->enforce_methods = base->enforce_methods;
    }

    return conf;
}

static const char *am_allowmethods(cmd_parms *cmd, void *d, int argc,
                                   char *const argv[])
{
    int i;
    am_conf_t *conf = (am_conf_t *)d;
    int merge = 0;
    int first = 1;
    char *method;
    char action = '\0';

    if (argc == 0) {
        return "AllowMethods: No method or 'reset' keyword given";
    }
    if (argc == 1) {
        if (!ap_cstr_casecmp(argv[0], "reset")) {
            conf->allowed         = 0;
            conf->enforce_methods = 0;
            conf->add             = 0;
            conf->remove          = 0;
            conf->allowed_set     = 1;
            return NULL;
        }
    }

    conf->allowed = 0;
    conf->add     = 0;
    conf->remove  = 0;

    for (i = 0; i < argc; i++) {
        int m;
        char *w = argv[i];

        if( *w == '-' || *w == '+' ) {
            if (!merge && !first) {
                return "Either all methods in AllowMethods must start with + or -, or no methods may.";
            }

            action = *(w++);
            method = w;
            merge = 1;
        }
        else if (merge) {
            return "Either all methods in AllowMethods must start with + or -, or no methods may.";
        }
        else {
            method = w;
        }

        m = ap_method_number_of((char const*)method);

        if (m == M_INVALID) {
            return apr_pstrcat(cmd->pool, "AllowMethods: Invalid Method '",
                               method, "'", NULL);
        }

        if (action == '-' ) {
            conf->remove  |=  (AP_METHOD_BIT << m);
            conf->add     &= ~(AP_METHOD_BIT << m);
            conf->allowed &= ~(AP_METHOD_BIT << m);
        }
        else if (action == '+' ) {
            conf->remove  &= ~(AP_METHOD_BIT << m);
            conf->add     |=  (AP_METHOD_BIT << m);
            conf->allowed |=  (AP_METHOD_BIT << m);
        }
        else {
            conf->allowed |= (AP_METHOD_BIT << m);
        }

        first = 0;
    }
    conf->allowed_set     = 1;
    conf->enforce_methods = 1;

    return NULL;
}

static void am_register_hooks(apr_pool_t * p)
{
    ap_hook_access_checker(am_check_access, NULL, NULL, APR_HOOK_REALLY_FIRST);
}

static const command_rec am_cmds[] = {
    AP_INIT_TAKE_ARGV("AllowMethods", am_allowmethods, NULL,
                      ACCESS_CONF,
                      "only allow specific methods"),
    {NULL}
};

AP_DECLARE_MODULE(allowmethods) = {
    STANDARD20_MODULE_STUFF,
    am_create_conf,
    am_merge_conf,
    NULL,
    NULL,
    am_cmds,
    am_register_hooks,
};