that we get less than 20% of the NOT_IN_LIMIT rules correct.
<Limit > works in about 4 directive contexts and yet, we ignore
this fact for 100's of directives. Simply eliminate this
nonsense in anticipation of a 100% solution.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@645190 13f79535-47bb-0310-9956-ffa450edef68
configurations which match those of the initial request. Revert to
the original behaviour (call access control hooks for internal requests
with URIs different from the initial request) if any access control hooks
or providers are not registered as permitting this optimization.
Introduce wrappers for access control hook and provider registration
which can accept additional mode and flag data.
The configuration walk optimizations were originally proposed a while
ago (see http://marc.info/?l=apache-httpd-dev&m=116536713506234&w=2);
they have been used since then in production systems and appear to be
stable and effective. They permit certain combinations of modules
and clients to function efficiently, especially when a deeply recursive
series of internal requests, such as those generated by certain WebDAV
requests, are all subject to the identical authentication and authorization
directives.
The major change from the original proposal is a cleaner mechanism for
detecting modules which may expect the old behaviour. This has been
tested successfully with Subversion's mod_authz_svn, which specifically
requires the old behaviour when performing path-based authorization based
against its own private access control configuration files.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@644525 13f79535-47bb-0310-9956-ffa450edef68
cannot be data symbols when mod_ssl is built as a loadable module;
using an external string constant in a loadable module is not portable.
Also reorganize file and sem to follow their explicit mechanisms,
and ensured that the explicit mechansims are listed in order of
preference.
This raises a question, would [fcntl|file] be a clearer way of
indiciating what the file/sem methods devolve to?
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@568833 13f79535-47bb-0310-9956-ffa450edef68
This does NOT address the remaining issues with relative settings and
FileETag mentioned in PR 42027, but at least it isolates the problem
to them. Currently these issues can be worked around with absolute
settings.
PR: 42027
Submitted by: Rici Lake <rici ricilake.net>
Reviewed by: rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@562860 13f79535-47bb-0310-9956-ffa450edef68
PR 38699, 39518, 42005, 42006, 42007, 42008, 42009
The patches are all his, and are sufficiently trivial to review
at a glance.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@557837 13f79535-47bb-0310-9956-ffa450edef68
locking method and the lockfile location, I never
liked how AcceptMutex was linked to LockFile. This
seemed unnecessary. Much better to have AcceptMutex
do both as well. Plus, now that we will likely see
other modules require a "standard" way of setting
mutexes, why not have Apache provide that as
an API of sorts.
Anyway, LockFile is now depreciated and AcceptMutex
is now SSLMutex-like. We also provide a short
function that "parses" out a mutex parameter
and strips out the mechanism and lockfile location.
AcceptMutex and SSLMutex is this capability.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@467326 13f79535-47bb-0310-9956-ffa450edef68
ap_get_server_description().
High-level summary:
The full server version information is now included in the error log at
startup as well as server status reports, irrespective of the setting
of the ServerTokens directive.
Third-party modules must now use ap_get_server_banner() or
ap_get_server_description() in place of ap_get_server_version().
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@440337 13f79535-47bb-0310-9956-ffa450edef68
about the useless use of AllowOverride.
PR: 39992
Submitted by: Darryl Miles <darryl darrylmiles.org>
Reviewed by: rpluem
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@420307 13f79535-47bb-0310-9956-ffa450edef68
'https', mod_http returns "https" for the ap_hook_http_scheme and
DEFAULT_HTTPS_PORT for ap_hook_default_port. This fixes Redirect
responses to requests for directories without a trailing slash
when httpd runs behind a proxy or offload device that processes
SSL. It also enables support for Subversion in that
configuration. This change is completely backwards compatible
and passes the perl-framework. Minor mmn bump because I add a
field to server_rec.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@399947 13f79535-47bb-0310-9956-ffa450edef68
Merge from branches/authz-dev
Basically here is a list of what has been done:
- Convert all of the authz modules from hook based to provider based
- Remove the ap_requires field from the core_dir_config structure
- Remove the function ap_requires() since its functionality is no
longer supported or necessary in the refactoring
- Remove the calls to ap_some_auth_required() in the core request
handling to allow the hooks to be called in all cases.
- Add the new module mod_authz_core which will act as the authorization
provider vector and contain common authz directives such as 'Require',
'Reject' and '<RequireAlias>'
- Add the new module mod_authn_core which will contain common
authentication directives such as 'AuthType', 'AuthName' and
'<AuthnProviderAlias>'
- Move the check for METHOD_MASK out of the authz providers and into
the authz_core provider vector
- Define the status codes that can be returned by the authz providers
as AUTHZ_DENIED, AUTHZ_GRANTED and AUTHZ_GENERAL_ERROR
- Remove the 'Satisfy' directive
- Implement the '<RequireAll>', '<RequireOne>' block directives to
handle the 'and' and 'or' logic for authorization.
- Remove the 'AuthzXXXAuthoritative' directives from all of the authz
providers
- Implement the 'Reject' directive that will deny authorization if the
argument is true
- Fold the 'Reject' directive into the '<RequireAll>', '<RequireOne>'
logic
- Reimplement the host based authorization functionality provided by
'allow', 'deny' and 'order' as authz providers
- Remove the 'allow', 'deny' and 'order' directives
- Merge mod_authn_alias into mod_authn_core
- Add '<RequireAlias>' functionality which is similar to
'<AuthnProviderAlias>' but specific to authorization aliasing
- Remove all of the references to the 'authzxxxAuthoritative'
directives from the documentation
- Remove the 'Satisfy' directive from the documentation
- Remove 'Allow', 'Deny', 'Order' directives from the documentation
- Document '<RequireAll>', '<RequireOne>', 'Reject' directives
- Reimplement the APIs ap_auth_type(), ap_auth_name() as optional
functions and move the actual implementation into mod_authn_core
- Reimplement the API ap_some_auth_required() as an optional function
and move the actual implementation into mod_authz_core
Major Changes:
- Added the directives <RequireAll>, <RequireOne>, <RequireAlias>,
Reject
- Expanded the functionality of the directive 'Require' to handle all
authorization and access control
- Added the new authz providers 'env', 'ip', 'host', 'all' to handle
host-based access control
- Removed the directives 'Allow', 'Deny', 'Order', 'Satisfy',
'AuthzXXXAuthoritative'
- Removed the ap_require() API
- Moved the directives 'AuthType', 'AuthName' out of mod_core and into
mod_authn_core
- Moved the directive 'Require' out of mod_core and into
mod_authz_core
- Merged mod_authn_alias into mod_authn_core
- Renamed mod_authz_dbm authz providers from 'group' and 'file-group'
to 'dbm-group' and 'dbm-file-group'
Benefits:
- All authorization and access control is now handle through two
directives, 'Require' and 'Reject'
- Authorization has been expanded to allow for complex 'AND/OR' control
logic through the directives '<RequireAll>' and '<RequireOne>'
- Configuration is now much simpler and consistent across the board
- Other modules like mod_ssl and mod_proxy should be able to plug into
and take advantage of the same provider based authorization mechanism
by implementing their own providers
Issues:
- Backwards compatibility between 2.2 and 2.3 configurations will be
broken in the area of authorization and access control due to the fact
that the directives 'allow', 'deny', 'order' and 'satisfy' have been
removed. When moving from 2.2 to 2.3 these directives will have to be
changed to 'Require all granted', 'Require all denied' or some variation
of the authz host-based providers.
- Existing third party authorization modules will have to adapt to the
new structure.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@368027 13f79535-47bb-0310-9956-ffa450edef68
basically allows Apache to configurably ( :) )
use the physical port when constructing the
canonical port. Also add the exact ordering to
the docs, so people can easily see how it works.
We now have compatibility with both 2.0 and 1.3.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@344369 13f79535-47bb-0310-9956-ffa450edef68
allowing ap_add_output_filters_by_type to handle proxied requests.
Basic tests by jorton and me show that this works, nobody can actually
remember why this limitation was introduced at all (r94028) and the mailing
list archives also gave no hint.
Submitted by: Joe Orton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@327179 13f79535-47bb-0310-9956-ffa450edef68
The core filter will NOT operate correctly across platforms
(even between Linux/Solaris) without setting up the conn->timeout,
so always apply the timeout when establishing the core filter.
The keep-alive-timeout is entirely an HTTP-ism, and needs to
move to the http protocol handler. Note #1; this isn't triggered
in the event mpm, but the event mpm introspects s->keep_alive_timeout
directly adding it to the pollset, so this is a non-sequitor.
Finally, once the headers are read, the named virtual host may
have a different (more/less permissive) timeout for the remainder
of the request body. This http-centric patch picks up that subtle
detail and can switch to a named-vhost timeout.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@306495 13f79535-47bb-0310-9956-ffa450edef68
that not one other member of the r->vars is initialized
herein. Move this initialization elsewhere.
(If this is the 'default' - it really aught to be the
zero value, for that matter).
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@295141 13f79535-47bb-0310-9956-ffa450edef68
I will be adding documentation for the new directives hopefully in the next day or so.
* server/core.c: Added 'Protocol' to the core module config
Added ap_{set,get}_server_protocol API.
Added new directive: 'AcceptFilter'.
Enable 'httpready' by default on systems that support it. Use dataready filters for others.
* server/listen.c: Attempt to inherit protocols from Listener Records to Server configs.
The 'Listen' directive can now optionally take a protocol arg
Move bits that determined which accept filter is applied to core.c.
Added bits to find the correct accept filter based on the core's configuration.
* include/{ap_listen.h,http_core.h}: Add Protocol to respective structures.
* include/http_core.h: Add the accf_map table to the core_server_config structure
* include/ap_mmn.h: Minor MMN Bump for the new interfacces.
* modules/ssl/ssl_engine_init.c: Use the new protocol framework to enable mod_ssl for 'https' websites.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@190563 13f79535-47bb-0310-9956-ffa450edef68
internalise the ap_reg*<->PCRE wrapper:
* configure.in: Add srclib/pcre to the include path.
* include/ap_regex.h: Renamed from include/pcreposix.h. Prefix all
constants with AP_; prefix all functions and types with ap_. Define
AP_DECLARE to nothing if necessary. Remove regcomp error codes.
* include/httpd.h: Include ap_regex.h not pcreposix.h.
(ap_pregcomp, ap_regexec, ap_regfree): s/regex_t/ap_regex_t/.
(ap_regexec, ap_regerror): Prototypes moved to ap_regex.h.
* server/util.c (regex_cleanup, ap_pregcomp, ap_pregsub, ap_pregfree):
Adjust for ap_ prefixed types. (ap_regexec, ap_regerror): Removed.
* server/Makefile.in: Build util_pcre.c.
* server/util_pcre.c: Copied from srclib/pcre/pcreposix.c; remove use
of PCRE-internals to do error mapping; rename types to add AP_/ap_
prefixes as above. Use APR includes. (ap_regerror): Use apr_snprintf.
* srclib/pcre/Makefile.in: Don't build pcreposix.c into libpcre.la.
* modules/*: Update to use new type and constant names.
PR: 27750 (part one)
Submitted by: Andres Salomon <dilinger voxel.net>, Joe Orton
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@153384 13f79535-47bb-0310-9956-ffa450edef68
Bumped mmn, and ap module cookie, for this function rename.
It's not a deprecation, as ap_http_method would be a lovely function
name sometime in the future: to determine what the function name implies.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@123882 13f79535-47bb-0310-9956-ffa450edef68
* server/core_filters.c (ap_core_input_filter, ap_core_output_filter,
ap_net_time_filter): Renamed to add ap_ prefixes for global symbols.
* include/ap_listen.h: Don't export ap_listen_open at all, it's not
used outside server/listen.c any more.
* server/listen.c (open_listeners): Renamed from ap_listen_open.
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@109498 13f79535-47bb-0310-9956-ffa450edef68
* Makefile.in: Change order of dependencies to bring in exports.o first so that
we have every symbol 'used' before the linker starts processing.
* build/rules.mk.in: Add a 'program-install' target which just copies httpd.
* server/Makefile.in, modules/http/config2.m4: Add in new file targets.
* NWGNUmakefile, libhttpd.dsp: Blind updates for Netware and Win32. (I tried.)
* server/core.c: Move core_input_filter, net_time_filter, and core_output_filter and all supporting functions to...
* server/core_filters.c (copied): ...here.
* modules/http/http_protocol.c: Move functions from here to there...namely:
* modules/http/byterange_filter.c (copied): Relocate ap_byterange_filter() and
friends.
* modules/http/chunk_filter.c (copied): Relocate chunk_filter().
* modules/http/http_etag.c (copied): Relocate ap_set_etag and ap_make_etag().
* modules/http/http_filters.c (copied): Relocate ap_http_filter(),
ap_http_header_filter(), ap_discard_request_body(), ap_setup_client_block(),
ap_should_client_block(), and ap_get_client_block().
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@106692 13f79535-47bb-0310-9956-ffa450edef68
