modules/aaa/mod_allowmethods.c

	mod_allowmethods.c revision 135c1278adef96d36fd421c536b1acc54a341cfb
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding/* Licensed to the Apache Software Foundation (ASF) under one or more
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * contributor license agreements.  See the NOTICE file distributed with
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * this work for additional information regarding copyright ownership.
b99dbaab171d91e1b664397cc40e039d0c087c65fielding * The ASF licenses this file to You under the Apache License, Version 2.0
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * (the "License"); you may not use this file except in compliance with
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * the License.  You may obtain a copy of the License at
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *     http://www.apache.org/licenses/LICENSE-2.0
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * Unless required by applicable law or agreed to in writing, software
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * distributed under the License is distributed on an "AS IS" BASIS,
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * See the License for the specific language governing permissions and
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding * limitations under the License.
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding */
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "httpd.h"
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding#include "http_core.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_config.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_protocol.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_request.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "http_log.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding#include "apr_strings.h"
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding/**
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * This module makes it easy to restrict what HTTP methods can be ran against
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * a server.
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * It provides one comand:
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *    AllowMethods
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding * This command takes a list of HTTP methods to allow.
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *
64185f9824e42f21ca7b9ae6c004484215c031a7rbb *  The most common configuration should be like this:
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *   <Directory />
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *    AllowMethods GET HEAD OPTIONS
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *   </Directory>
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *   <Directory /special/cgi-bin>
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *      AllowMethods GET HEAD OPTIONS POST
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding *   </Directory>
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *  Non-matching methods will be returned a status 405 (method not allowed)
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *  To allow all methods, and effectively turn off mod_allowmethods, use:
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding *    AllowMethods reset
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding */
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingtypedef struct am_conf_t {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  int allowed;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding} am_conf_t;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingmodule AP_MODULE_DECLARE_DATA allowmethods_module;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffieldingstatic int am_check_access(request_rec *r)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding  int method = r->method_number;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding  am_conf_t *conf;
7e79e8fd53348f9fc6e8009a4a2522425ab6f08ffielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  conf = (am_conf_t *) ap_get_module_config(r->per_dir_config,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding                                            &allowmethods_module);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  if (!conf || conf->allowed == 0) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    return DECLINED;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  r->allowed = conf->allowed;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  if (conf->allowed & (AP_METHOD_BIT << method)) {
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein    return DECLINED;
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein  }
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein  ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein                  "client method denied by server configuration: '%s' to %s%s",
1b21d7b3d97def358b2e923655edeb16613a1c31gstein                  r->method,
be3223a6a18d9a3a3cf7155d5430a5d92bcddceegstein                  r->filename ? "" : "uri ",
1b21d7b3d97def358b2e923655edeb16613a1c31gstein                  r->filename ? r->filename : r->uri);
1b21d7b3d97def358b2e923655edeb16613a1c31gstein
1b21d7b3d97def358b2e923655edeb16613a1c31gstein  return HTTP_METHOD_NOT_ALLOWED;
1b21d7b3d97def358b2e923655edeb16613a1c31gstein}
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein
cccd31fa4a72fe23cc3249c06db181b274a55a69gsteinstatic void *am_create_conf(apr_pool_t * p, char *dummy)
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein{
cccd31fa4a72fe23cc3249c06db181b274a55a69gstein  am_conf_t *conf = apr_pcalloc(p, sizeof(am_conf_t));
1b21d7b3d97def358b2e923655edeb16613a1c31gstein
1b21d7b3d97def358b2e923655edeb16613a1c31gstein  conf->allowed = 0;
1b21d7b3d97def358b2e923655edeb16613a1c31gstein  return conf;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
cccd31fa4a72fe23cc3249c06db181b274a55a69gsteinstatic void* am_merge_conf(apr_pool_t* pool, void* a, void* b) {
b0f20a4a26bcfa85724b1c2e5ec6a077f12ef44crbb  am_conf_t* base = (am_conf_t*) a;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_conf_t* add = (am_conf_t*) b;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_conf_t* conf = apr_palloc(pool, sizeof(am_conf_t));
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  conf->allowed = add->allowed ? add->allowed : base->allowed;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  return conf;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic const char *am_allowmethods(cmd_parms *cmd, void *d, int argc, char *const argv[])
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  int i;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_conf_t* conf = (am_conf_t*) d;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  if (argc == 1) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (strcasecmp("reset", argv[0]) == 0) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding      conf->allowed = 0;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding      return NULL;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  for (i = 0; i < argc; i++) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    int m = 0;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    m = ap_method_number_of(argv[i]);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    if (m == M_INVALID) {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding      return apr_pstrcat(cmd->pool, "AllowMethods: Invalid Method '", argv[i], "'", NULL);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding    conf->allowed |= (AP_METHOD_BIT << m);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  }
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  return NULL;
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic void am_register_hooks(apr_pool_t * p)
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding{
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  ap_hook_access_checker(am_check_access, NULL, NULL, APR_HOOK_REALLY_FIRST);
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingstatic const command_rec am_cmds[] = {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  AP_INIT_TAKE_ARGV("AllowMethods", am_allowmethods, NULL,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding              ACCESS_CONF,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding              "only allow specific methods"),
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  {NULL}
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding};
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fieldingmodule AP_MODULE_DECLARE_DATA allowmethods_module = {
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  STANDARD20_MODULE_STUFF,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_create_conf,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_merge_conf,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  NULL,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  NULL,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_cmds,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding  am_register_hooks,
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding};
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding
09fe0b69d3d1e8c8041c9ce99ee77b8b44b5e3b1fielding