mod_access.c revision 1b21d7b3d97def358b2e923655edeb16613a1c31
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele/* ====================================================================
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * The Apache Software License, Version 1.1
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Copyright (c) 2000 The Apache Software Foundation. All rights
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Redistribution and use in source and binary forms, with or without
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * modification, are permitted provided that the following conditions
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * 1. Redistributions of source code must retain the above copyright
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * notice, this list of conditions and the following disclaimer.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * 2. Redistributions in binary form must reproduce the above copyright
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * notice, this list of conditions and the following disclaimer in
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * the documentation and/or other materials provided with the
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * distribution.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * 3. The end-user documentation included with the redistribution,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * if any, must include the following acknowledgment:
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * "This product includes software developed by the
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Apache Software Foundation (http://www.apache.org/)."
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Alternately, this acknowledgment may appear in the software itself,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * if and wherever such third-party acknowledgments normally appear.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * 4. The names "Apache" and "Apache Software Foundation" must
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * not be used to endorse or promote products derived from this
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * software without prior written permission. For written
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * permission, please contact apache@apache.org.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * 5. Products derived from this software may not be called "Apache",
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * nor may "Apache" appear in their name, without prior written
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * permission of the Apache Software Foundation.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * SUCH DAMAGE.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * ====================================================================
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * This software consists of voluntary contributions made by many
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * individuals on behalf of the Apache Software Foundation. For more
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * information on the Apache Software Foundation, please see
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Portions of this software are based upon public domain software
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * originally written at the National Center for Supercomputing Applications,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * University of Illinois, Urbana-Champaign.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Security options etc.
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele * Module derived from code originally written by Rob McCool
4ab980a06412fd86f52a6d054fb7e26de155c530erikabeletypedef struct {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele unsigned long net;
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele unsigned long mask;
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele/* things in the 'order' array */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabeletypedef struct {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabelestatic void *create_access_dir_config(apr_pool_t *p, char *dummy)
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele (access_dir_conf *) apr_pcalloc(p, sizeof(access_dir_conf));
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele for (i = 0; i < METHODS; ++i)
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele conf->allows = apr_array_make(p, 1, sizeof(allowdeny));
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele conf->denys = apr_array_make(p, 1, sizeof(allowdeny));
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return (void *) conf;
4ab980a06412fd86f52a6d054fb7e26de155c530erikabelestatic const char *order(cmd_parms *cmd, void *dv, const char *arg)
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "unknown order";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele for (i = 0; i < METHODS; ++i)
4ab980a06412fd86f52a6d054fb7e26de155c530erikabelestatic const char *allow_cmd(cmd_parms *cmd, void *dv, const char *from,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele const char *where_c)
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "allow and deny must be followed by 'from'";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele a = (allowdeny *) apr_array_push(cmd->info ? d->allows : d->denys);
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele unsigned long mask;
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele /* trample on where, we won't be using it any more */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele *s++ = '\0';
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele || (a->x.ip.net = apr_inet_addr(where)) == APR_INADDR_NONE) {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "syntax error in network portion of network/netmask";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele /* is_ip just tests if it matches [\d.]+ */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "syntax error in mask portion of network/netmask";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele /* is it in /a.b.c.d form? */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "syntax error in mask portion of network/netmask";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele /* assume it's in /nnn form */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "invalid mask in network/netmask";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele a->x.ip.net = (a->x.ip.net & mask); /* pjr - This fixes PR 4770 */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele /* legacy syntax for ip addrs: a.b.c. ==> a.b.c.0/24 for example */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele /* parse components */
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele while (*s) {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "invalid ip address";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele while (apr_isdigit(*t)) {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele if (*t == '.') {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele else if (*t) {
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "invalid ip address";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "invalid ip address, only 4 octets allowed";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele return "each octet must be between 0 and 255 inclusive";
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele "'allow,deny', 'deny,allow', or 'mutual-failure'"),
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele AP_INIT_ITERATE2("allow", allow_cmd, &its_an_allow, OR_LIMIT,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele "'from' followed by hostnames or IP-address wildcards"),
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele AP_INIT_ITERATE2("deny", allow_cmd, NULL, OR_LIMIT,
4ab980a06412fd86f52a6d054fb7e26de155c530erikabele "'from' followed by hostnames or IP-address wildcards"),
4ab980a06412fd86f52a6d054fb7e26de155c530erikabelestatic int in_domain(const char *domain, const char *what)
int gothost = 0;
for (i = 0; i < a->nelts; ++i) {
case T_ENV:
case T_ALL:
case T_IP:
case T_HOST:
if (!gothost) {
case T_FAIL:
access_dir_conf *a =
(access_dir_conf *)
r->filename);
return ret;