Merge from branches/authz-dev
Basically here is a list of what has been done:
- Convert all of the authz modules from hook based to provider based
- Remove the ap_requires field from the core_dir_config structure
- Remove the function ap_requires() since its functionality is no
longer supported or necessary in the refactoring
- Remove the calls to ap_some_auth_required() in the core request
handling to allow the hooks to be called in all cases.
- Add the new module mod_authz_core which will act as the authorization
provider vector and contain common authz directives such as 'Require',
'Reject' and '<RequireAlias>'
- Add the new module mod_authn_core which will contain common
authentication directives such as 'AuthType', 'AuthName' and
'<AuthnProviderAlias>'
- Move the check for METHOD_MASK out of the authz providers and into
the authz_core provider vector
- Define the status codes that can be returned by the authz providers
as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR
- Remove the 'Satisfy' directive
- Implement the '<RequireAll>', '<RequireOne>' block directives to
handle the 'and' and 'or' logic for authorization.
- Remove the 'AuthzXXXAuthoritative' directives from all of the authz
providers
- Implement the 'Reject' directive that will deny authorization if the
argument is true
- Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>'
logic
- Reimplement the host based authorization functionality provided by
'allow', 'deny' and 'order' as authz providers
- Remove the 'allow', 'deny' and 'order' directives
- Merge mod_authn_alias into mod_authn_core
- Add '<RequireAlias>' functionality which is similar to
'<AuthnProviderAlias>' but specific to authorization aliasing
- Remove all of the references to the 'authzxxxAuthoritative'
directives from the documentation
- Remove the 'Satisfy' directive from the documentation
- Remove 'Allow', 'Deny', 'Order' directives from the documentation
- Document '<RequireAll>', '<RequireOne>', 'Reject' directives
- Reimplement the APIs ap_auth_type(), ap_auth_name() as optional
functions and move the actual implementation into mod_authn_core
- Reimplement the API ap_some_auth_required() as an optional function
and move the actual implementation into mod_authz_core
Major Changes:
- Added the directives <RequireAll>, <RequireOne>, <RequireAlias>,
Reject
- Expanded the functionality of the directive 'Require' to handle all
authorization and access control
- Added the new authz providers 'env', 'ip', 'host', 'all' to handle
host-based access control
- Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy',
'AuthzXXXAuthoritative'
- Removed the ap_require() API
- Moved the directives 'AuthType', 'AuthName' out of mod_core and into
mod_authn_core
- Moved the directive 'Require' out of mod_core and into
mod_authz_core
- Merged mod_authn_alias into mod_authn_core
- Renamed mod_authz_dbm authz providers from 'group' and 'file-group'
to 'dbm-group' and 'dbm-file-group'
Benefits:
- All authorization and access control is now handle through two
directives, 'Require' and 'Reject'
- Authorization has been expanded to allow for complex 'AND/OR' control
logic through the directives '<RequireAll>' and '<RequireOne>'
- Configuration is now much simpler and consistent across the board
- Other modules like mod_ssl and mod_proxy should be able to plug into
and take advantage of the same provider based authorization mechanism
by implementing their own providers
Issues:
- Backwards compatibility between 2.2 and 2.3 configurations will be
broken in the area of authorization and access control due to the fact
that the directives 'allow', 'deny', 'order' and 'satisfy' have been
removed. When moving from 2.2 to 2.3 these directives will have to be
changed to 'Require all granted', 'Require all denied' or some variation
of the authz host-based providers.
- Existing third party authorization modules will have to adapt to the
new structure.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368027 13f79535-47bb-0310-9956-ffa450edef68
basically allows Apache to configurably ( :) )
use the physical port when constructing the
canonical port. Also add the exact ordering to
the docs, so people can easily see how it works.
We now have compatibility with both 2.0 and 1.3.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@344369 13f79535-47bb-0310-9956-ffa450edef68
The core filter will NOT operate correctly across platforms
(even between Linux/Solaris) without setting up the conn->timeout,
so always apply the timeout when establishing the core filter.
The keep-alive-timeout is entirely an HTTP-ism, and needs to
move to the http protocol handler. Note #1; this isn't triggered
in the event mpm, but the event mpm introspects s->keep_alive_timeout
directly adding it to the pollset, so this is a non-sequitor.
Finally, once the headers are read, the named virtual host may
have a different (more/less permissive) timeout for the remainder
of the request body. This http-centric patch picks up that subtle
detail and can switch to a named-vhost timeout.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@306495 13f79535-47bb-0310-9956-ffa450edef68
I will be adding documentation for the new directives hopefully in the next day or so.
* server/core.c: Added 'Protocol' to the core module config
Added ap_{set,get}_server_protocol API.
Added new directive: 'AcceptFilter'.
Enable 'httpready' by default on systems that support it. Use dataready filters for others.
* server/listen.c: Attempt to inherit protocols from Listener Records to Server configs.
The 'Listen' directive can now optionally take a protocol arg
Move bits that determined which accept filter is applied to core.c.
Added bits to find the correct accept filter based on the core's configuration.
* include/{ap_listen.h,http_core.h}: Add Protocol to respective structures.
* include/http_core.h: Add the accf_map table to the core_server_config structure
* include/ap_mmn.h: Minor MMN Bump for the new interfacces.
* modules/ssl/ssl_engine_init.c: Use the new protocol framework to enable mod_ssl for 'https' websites.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190563 13f79535-47bb-0310-9956-ffa450edef68
With Apache 1.3.x, it is a bit simpler as the request does
not go through ap_make_content_type().
Modules can set custom error responses but not be able to
set the charset, so they have to code the charset in the
html. Thus, it is useful to preserve 1.3.x behavior exactly.
PR: 26467
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@170354 13f79535-47bb-0310-9956-ffa450edef68
internalise the ap_reg*<->PCRE wrapper:
* configure.in: Add srclib/pcre to the include path.
* include/ap_regex.h: Renamed from include/pcreposix.h. Prefix all
constants with AP_; prefix all functions and types with ap_. Define
AP_DECLARE to nothing if necessary. Remove regcomp error codes.
* include/httpd.h: Include ap_regex.h not pcreposix.h.
(ap_pregcomp, ap_regexec, ap_regfree): s/regex_t/ap_regex_t/.
(ap_regexec, ap_regerror): Prototypes moved to ap_regex.h.
* server/util.c (regex_cleanup, ap_pregcomp, ap_pregsub, ap_pregfree):
Adjust for ap_ prefixed types. (ap_regexec, ap_regerror): Removed.
* server/Makefile.in: Build util_pcre.c.
* server/util_pcre.c: Copied from srclib/pcre/pcreposix.c; remove use
of PCRE-internals to do error mapping; rename types to add AP_/ap_
prefixes as above. Use APR includes. (ap_regerror): Use apr_snprintf.
* srclib/pcre/Makefile.in: Don't build pcreposix.c into libpcre.la.
* modules/*: Update to use new type and constant names.
PR: 27750 (part one)
Submitted by: Andres Salomon <dilinger voxel.net>, Joe Orton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153384 13f79535-47bb-0310-9956-ffa450edef68
* server/core_filters.c (ap_core_input_filter, ap_core_output_filter,
ap_net_time_filter): Renamed to add ap_ prefixes for global symbols.
* include/ap_listen.h: Don't export ap_listen_open at all, it's not
used outside server/listen.c any more.
* server/listen.c (open_listeners): Renamed from ap_listen_open.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@109498 13f79535-47bb-0310-9956-ffa450edef68
control over what options can be used in .htaccess files.
PR: 29310
Submitted by: Tom Alsberg <alsbergt-apache cs.huji.ac.il>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@104283 13f79535-47bb-0310-9956-ffa450edef68
The core per-dir config would later point to request pool data
that would be reused for different purposes on different requests.
This is based on an old 1.3 patch submitted by Will Lowe.
It needs a minor tweak before committing to 1.3, but he had
it pretty darn close.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103120 13f79535-47bb-0310-9956-ffa450edef68
new LimitInternalRecursion directive configures limits of subsequent
internal redirects and nested subrequests, after which the request
will be aborted.
[William Rowe, Jeff Trawick, Andr� Malo]
PR: 19753 (and probably others)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@99911 13f79535-47bb-0310-9956-ffa450edef68
decoded into '/', allowing the *_walk to do their magic and
return 404 if it's in the path, and allowing it in the path-info.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98479 13f79535-47bb-0310-9956-ffa450edef68
The rfc1413 code itself is mostly c&p, but can still bear
some rework ...
This patch removes the global ap_rfc1413 function and the
ap_rfc1413_timeout variable. It also introduces a new config
directive IdentityCheckTimeout (default 30 sec).
Reviewed by: Justin Erenkrantz
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@98320 13f79535-47bb-0310-9956-ffa450edef68
call in the core_output_filter, in order to get a more accurate count
of the total bytes transmitted in cases where the client terminates
the connection before the entire response is sent.
Note: This works by adding a flush bucket to each response when
mod_logio is used; the side-effect is that pipelined responses
get broken up into separate network writes per request (but there's
no impact on pipelining when mod_logio is not enabled).
Submitted by: Bojan Smojver <bojan@rexursive.com>
Reviewed by: Brian Pane
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97300 13f79535-47bb-0310-9956-ffa450edef68
to disable sendfile mechanics for NFS volume mounts and other kernel
objects that don't support sendfile. And EnableSendfile off can be used
to help narrow bugs down to the sendfile mechanics or eliminate the
possiblity that sendfile is a factor on any given platform.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97205 13f79535-47bb-0310-9956-ffa450edef68
processors located in the output filter stack. This is on by default,
but will change "soon" to off -- the processors will then need to
enable it when they are installed into the filter chain.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@97065 13f79535-47bb-0310-9956-ffa450edef68
ap_*_client_block to ap_http_filter (aka HTTP_IN). This is the
only appropriate place for limit checking to occur (otherwise,
chunked input is not correctly limited).
Also changed the type of limit_req_body to apr_off_t to match the
other types inside of HTTP_IN. Also made the strtol call for
limit_req_body a bit more robust.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92700 13f79535-47bb-0310-9956-ffa450edef68
Moved the directory/location/file-walk caches from the
request's pool userdata hash table to the core_request_config
struct.
This change removes about 60% of the processing time from
prep_walk_cache().
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@92684 13f79535-47bb-0310-9956-ffa450edef68
roll build_command_line/build_argv_list into a unified, overrideable
ap_cgi_build_command optional function.
Eliminates a ton of Win32 cruft from core.c for registry parsing.
Win32 (through the default handler, and newest changes to the
apr_proc_create fn) continues to serve .bat/.exe files. This is in
preparation for adding modules/arch/win32/mod_win32 for scripts.
Please review the mod_cgi.c behavior very carefully.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@91058 13f79535-47bb-0310-9956-ffa450edef68
must be semicolon delimited (if more than one filter is given.)
The Set{Input|Output}Filter directive now overrides a parent
container's directive (e.g. SetInputFilter in <Directory /web/foo>
will override any SetInputFilter directive in <Directory /web>.)
This new syntax is more consistent with Add{Input|Output}Filter
directives defined in mod_mime. Also cures a bug in prior releases
where the Set{Input|Output}Filter directive would corrupt the
global configuration if the multiple directives were nested.
[William Rowe]
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@90799 13f79535-47bb-0310-9956-ffa450edef68
introduce the ForceType and SetHandler [absolute references] directly
into the very top of the fixups phase. This means these will always
override _any_ mime module, not just mod_mime. Ergo, other mime modules
can continue to set charset, encodings, etc. Since these are globals,
they belong in the core.
This highlights a very serious drawback to the type_checker hook. By
using run first, a module that identifies _partial_ information (maybe
just the content type) won't pass the query on to other modules, like
mod_mime, that might further define the encoding or charset. The
type_checker hook should clearly become a run-all, and the modules should
decline if they see someone ahead of them answered a question they were
going to try to figure.
Which means - if type_checker becomes RUN_ALL - this new override hook
fn should become a type_checker again - and RUN_REALLY_FIRST, and let
other modules _choose_ not to override this election. (We can run it
again at the end, for a recount ;) Votes?
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@90797 13f79535-47bb-0310-9956-ffa450edef68
ap_directory_walk() phase. Modules that want to use special
walk logic should refer to the mod_proxy map_to_location example,
with it's proxy_walk and proxysection implementation. This makes
either directory_walk flavor much more legible, since that phase
only runs against real <Directory > blocks.
On a technical note, this patch also forces the Directory to be
canonical (unless it is "/" or a regex.) It also allows us to
be more explicit when declaring <Directory > block errors.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@90684 13f79535-47bb-0310-9956-ffa450edef68
out the last patch before I rearranged this to be _readable_.
Next step for everyone's sanity, provide <Proxy > directives ;)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@90646 13f79535-47bb-0310-9956-ffa450edef68
and have those methods <limit>able in the httpd.conf. It uses
the same bit mask/shifted offset as the original HTTP methods
such as M_GET or M_POST, but expands the total bits from an int to
an ap_int64_t to handle more bits for new request methods than
an int provides.
Submitted by: Cody Sherr <csherr@covalent.net>
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@89869 13f79535-47bb-0310-9956-ffa450edef68
