mod_authz_groupfile.c revision 7e5764d5fbd900f21ef536c34357d8b8a1d51f90
/* ====================================================================
* The Apache Software License, Version 1.1
*
* Copyright (c) 2000-2002 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Apache" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*
* This software consists of voluntary contributions made by many
* individuals on behalf of the Apache Software Foundation. For more
* information on the Apache Software Foundation, please see
*
* Portions of this software are based upon public domain software
* originally written at the National Center for Supercomputing Applications,
* University of Illinois, Urbana-Champaign.
*/
/* This module is triggered by an
*
*
* and the presense of a
*
* require group <list-of-groups>
*
*
* If there are no AuthzGroupFile directives valid for
* the request; we DECLINED.
*
* If the AuthzGroupFile is defined; but somehow not
* accessible: we SERVER_ERROR (was DECLINED).
*
* If there are no 'require ' directives defined for
* this request then we DECLINED (was OK).
*
* If there are no 'require ' directives valid for
* this request method then we DECLINED. (was OK)
*
* If there are any 'require group' blocks and we
* are not in any group - we HTTP_UNAUTHORIZE
* unless we are non-authoritative; in which
* case we DECLINED.
*
*/
#include "apr_strings.h"
#include "apr_md5.h" /* for apr_password_validate */
#include "ap_config.h"
#include "httpd.h"
#include "http_config.h"
#include "http_core.h"
#include "http_log.h"
#include "http_protocol.h"
#include "http_request.h"
typedef struct {
char *groupfile;
int authoritative;
static void *create_authz_groupfile_dir_config(apr_pool_t *p, char *d)
{
return conf;
}
const char *t)
{
if (t && strcmp(t, "standard")) {
}
}
static const command_rec authz_groupfile_cmds[] =
{
"text file containing group names and member user IDs"),
(void *)APR_OFFSETOF(authz_groupfile_config_rec,
"Set to 'no' to allow access control to be passed along to "
"lower modules if the 'require group' fails. (default is "
"no)."),
{NULL}
};
apr_table_t ** out)
{
ap_configfile_t *f;
apr_pool_t *sp;
char l[MAX_STRING_LEN];
const char *group_name, *ll, *w;
return status ;
}
apr_pool_create(&sp, p);
while (!(ap_cfg_getline(l, MAX_STRING_LEN, f))) {
if ((l[0] == '#') || (!l[0])) {
continue;
}
ll = l;
while (ll[0]) {
break;
}
}
}
ap_cfg_closefile(f);
return APR_SUCCESS;
}
/* Checking ID */
static int check_user_access(request_rec *r)
{
int m = r->method_number;
int method_restricted = 0;
register int x,has_entries;
const char *t, *w;
if (!reqs_arr) {
return DECLINED; /* XXX change from legacy */
}
/* If there is no group file - then we are not
* configured. So decline.
*/
return DECLINED;
&grpstatus)) != APR_SUCCESS) {
return HTTP_INTERNAL_SERVER_ERROR;
};
continue;
}
method_restricted |= 1;
t = reqs[x].requirement;
w = ap_getword_white(r->pool, &t);
if (!strcmp(w, "group")) {
method_restricted |= 2;
if (has_entries) {
while (t[0]) {
w = ap_getword_conf(r->pool, &t);
if (apr_table_get(grpstatus, w)) {
return OK;
}
}
}
}
}
/* No applicable requires for this method seen at all */
if (method_restricted == 0) {
return DECLINED; /* XXX change from legacy */
}
/* No applicable "requires group" for this method seen */
if ((method_restricted & 2) == 0) {
return DECLINED;
}
if (!(conf->authoritative)) {
return DECLINED;
}
"access to %s failed, reason: user %s not part of the "
return HTTP_UNAUTHORIZED;
}
static void register_hooks(apr_pool_t *p)
{
}
{
create_authz_groupfile_dir_config,/* dir config creater */
NULL, /* dir merger -- default is to override */
NULL, /* server config */
NULL, /* merge server config */
authz_groupfile_cmds, /* command apr_table_t */
register_hooks /* register hooks */
};