a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "apr_strings.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "apr_network_io.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "apr_lib.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#define APR_WANT_STRFUNC

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#define APR_WANT_BYTEFUNC

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "apr_want.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "ap_config.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "httpd.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "http_core.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "http_config.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "http_log.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include "http_request.h"

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#if APR_HAVE_NETINET_IN_H

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#include <netinet/in.h>

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#endif

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndenum allowdeny_type {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd T_ENV,

a78048ccbdb6256da15e6b0e7e95355e480c2301nd T_ALL,

a78048ccbdb6256da15e6b0e7e95355e480c2301nd T_IP,

a78048ccbdb6256da15e6b0e7e95355e480c2301nd T_HOST,

a78048ccbdb6256da15e6b0e7e95355e480c2301nd T_FAIL

a78048ccbdb6256da15e6b0e7e95355e480c2301nd};

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndtypedef struct {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd int limited;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd union {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd char *from;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd apr_ipsubnet_t *ip;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd } x;

ae7dbf2e8aa89e1ec81c293ab3f1066f1cf1401fnd enum allowdeny_type type;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd} allowdeny;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#define DENY_THEN_ALLOW 0

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#define ALLOW_THEN_DENY 1

a78048ccbdb6256da15e6b0e7e95355e480c2301nd#define MUTUAL_FAILURE 2

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndtypedef struct {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd int order[METHODS];

a78048ccbdb6256da15e6b0e7e95355e480c2301nd apr_array_header_t *allows;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd apr_array_header_t *denys;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd} access_dir_conf;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndmodule AP_MODULE_DECLARE_DATA access_module;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndstatic void *create_access_dir_config(apr_pool_t *p, char *dummy)

a78048ccbdb6256da15e6b0e7e95355e480c2301nd{

a78048ccbdb6256da15e6b0e7e95355e480c2301nd access_dir_conf *conf =

a78048ccbdb6256da15e6b0e7e95355e480c2301nd (access_dir_conf *) apr_pcalloc(p, sizeof(access_dir_conf));

a78048ccbdb6256da15e6b0e7e95355e480c2301nd int i;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd for (i = 0; i < METHODS; ++i)

a78048ccbdb6256da15e6b0e7e95355e480c2301nd conf->order[i] = DENY_THEN_ALLOW;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd conf->allows = apr_array_make(p, 1, sizeof(allowdeny));

a78048ccbdb6256da15e6b0e7e95355e480c2301nd conf->denys = apr_array_make(p, 1, sizeof(allowdeny));

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return (void *) conf;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd}

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndstatic const char *order(cmd_parms *cmd, void *dv, const char *arg)

a78048ccbdb6256da15e6b0e7e95355e480c2301nd{

a78048ccbdb6256da15e6b0e7e95355e480c2301nd access_dir_conf *d = (access_dir_conf *) dv;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd int i, o;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd if (!strcasecmp(arg, "allow,deny"))

a78048ccbdb6256da15e6b0e7e95355e480c2301nd o = ALLOW_THEN_DENY;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else if (!strcasecmp(arg, "deny,allow"))

a78048ccbdb6256da15e6b0e7e95355e480c2301nd o = DENY_THEN_ALLOW;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else if (!strcasecmp(arg, "mutual-failure"))

a78048ccbdb6256da15e6b0e7e95355e480c2301nd o = MUTUAL_FAILURE;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return "unknown order";

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd for (i = 0; i < METHODS; ++i)

a78048ccbdb6256da15e6b0e7e95355e480c2301nd if (cmd->limited & (1 << i))

a78048ccbdb6256da15e6b0e7e95355e480c2301nd d->order[i] = o;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return NULL;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd}

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301ndstatic const char *allow_cmd(cmd_parms *cmd, void *dv, const char *from,

a78048ccbdb6256da15e6b0e7e95355e480c2301nd const char *where_c)

a78048ccbdb6256da15e6b0e7e95355e480c2301nd{

a78048ccbdb6256da15e6b0e7e95355e480c2301nd access_dir_conf *d = (access_dir_conf *) dv;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd allowdeny *a;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd char *where = apr_pstrdup(cmd->pool, where_c);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd char *s;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd char msgbuf[120];

a78048ccbdb6256da15e6b0e7e95355e480c2301nd apr_status_t rv;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd if (strcasecmp(from, "from"))

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return "allow and deny must be followed by 'from'";

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a = (allowdeny *) apr_array_push(cmd->info ? d->allows : d->denys);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->x.from = where;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->limited = cmd->limited;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd if (!strncasecmp(where, "env=", 4)) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->type = T_ENV;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->x.from += 4;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else if (!strcasecmp(where, "all")) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->type = T_ALL;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else if ((s = strchr(where, '/'))) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd *s++ = '\0';

a78048ccbdb6256da15e6b0e7e95355e480c2301nd rv = apr_ipsubnet_create(&a->x.ip, where, s, cmd->pool);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd if(APR_STATUS_IS_EINVAL(rv)) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd /* looked nothing like an IP address */

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return "An IP address was expected";

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else if (rv != APR_SUCCESS) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd apr_strerror(rv, msgbuf, sizeof msgbuf);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return apr_pstrdup(cmd->pool, msgbuf);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->type = T_IP;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else if (!APR_STATUS_IS_EINVAL(rv = apr_ipsubnet_create(&a->x.ip, where, NULL, cmd->pool))) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd if (rv != APR_SUCCESS) {

a78048ccbdb6256da15e6b0e7e95355e480c2301nd apr_strerror(rv, msgbuf, sizeof msgbuf);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd return apr_pstrdup(cmd->pool, msgbuf);

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->type = T_IP;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

a78048ccbdb6256da15e6b0e7e95355e480c2301nd else { /* no slash, didn't look like an IP address => must be a host */

a78048ccbdb6256da15e6b0e7e95355e480c2301nd a->type = T_HOST;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd }

e609c337f729875bc20e01096c7e610f45356f54nilgun

e609c337f729875bc20e01096c7e610f45356f54nilgun return NULL;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd}

6eed902e5b4d3e016e220bfbf8769a87c4cb242enoodl

a78048ccbdb6256da15e6b0e7e95355e480c2301ndstatic char its_an_allow;

a78048ccbdb6256da15e6b0e7e95355e480c2301nd

static const command_rec access_cmds[] =

{

AP_INIT_TAKE1("order", order, NULL, OR_LIMIT,

"'allow,deny', 'deny,allow', or 'mutual-failure'"),

AP_INIT_ITERATE2("allow", allow_cmd, &its_an_allow, OR_LIMIT,

"'from' followed by hostnames or IP-address wildcards"),

AP_INIT_ITERATE2("deny", allow_cmd, NULL, OR_LIMIT,

"'from' followed by hostnames or IP-address wildcards"),

{NULL}

};

static int in_domain(const char *domain, const char *what)

{

int dl = strlen(domain);

int wl = strlen(what);

if ((wl - dl) >= 0) {

if (strcasecmp(domain, &what[wl - dl]) != 0)

return 0;

/* Make sure we matched an *entire* subdomain --- if the user

if (wl == dl)

return 1; /* matched whole thing */

else

return (domain[0] == '.' || what[wl - dl - 1] == '.');

}

else

return 0;

}

static int find_allowdeny(request_rec *r, apr_array_header_t *a, int method)

{

allowdeny *ap = (allowdeny *) a->elts;

int mmask = (1 << method);

int i;

int gothost = 0;

const char *remotehost = NULL;

for (i = 0; i < a->nelts; ++i) {

if (!(mmask & ap[i].limited))

continue;

switch (ap[i].type) {

case T_ENV:

if (apr_table_get(r->subprocess_env, ap[i].x.from)) {

return 1;

}

break;

case T_ALL:

return 1;

case T_IP:

if (apr_ipsubnet_test(ap[i].x.ip, r->connection->remote_addr)) {

return 1;

}

break;

case T_HOST:

if (!gothost) {

int remotehost_is_ip;

remotehost = ap_get_remote_host(r->connection, r->per_dir_config,

REMOTE_DOUBLE_REV, &remotehost_is_ip);

if ((remotehost == NULL) || remotehost_is_ip)

gothost = 1;

else

gothost = 2;

}

if ((gothost == 2) && in_domain(ap[i].x.from, remotehost))

return 1;

break;

case T_FAIL:

/* do nothing? */

break;

}

}

return 0;

}

static int check_dir_access(request_rec *r)

{

int method = r->method_number;

access_dir_conf *a =

(access_dir_conf *)

ap_get_module_config(r->per_dir_config, &access_module);

int ret = OK;

if (a->order[method] == ALLOW_THEN_DENY) {

ret = HTTP_FORBIDDEN;

if (find_allowdeny(r, a->allows, method))

ret = OK;

if (find_allowdeny(r, a->denys, method))

ret = HTTP_FORBIDDEN;

}

else if (a->order[method] == DENY_THEN_ALLOW) {

if (find_allowdeny(r, a->denys, method))

ret = HTTP_FORBIDDEN;

if (find_allowdeny(r, a->allows, method))

ret = OK;

}

else {

if (find_allowdeny(r, a->allows, method)

&& !find_allowdeny(r, a->denys, method))

ret = OK;

else

ret = HTTP_FORBIDDEN;

}

if (ret == HTTP_FORBIDDEN

&& (ap_satisfies(r) != SATISFY_ANY || !ap_some_auth_required(r))) {

ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,

"client denied by server configuration: %s",

r->filename);

}

return ret;

}

static void register_hooks(apr_pool_t *p)

{

ap_hook_access_checker(check_dir_access,NULL,NULL,APR_HOOK_MIDDLE);

}

module AP_MODULE_DECLARE_DATA access_module =

{

STANDARD20_MODULE_STUFF,

create_access_dir_config, /* dir config creater */

NULL, /* dir merger --- default is to override */

NULL, /* server config */

NULL, /* merge server config */

access_cmds,

register_hooks /* register hooks */

};