[users@httpd] Proxying Problem: Need DirectoryMatch help!

[Iago <ia...@iago.net>]

What I'm using:

    Server: Apache/1.3.20 (Unix)

The problem:

    I'm currently facing an "open proxy" problem --
    introduced by my desire to get requests proxied for one
    host and one host only.

    I need help figuring out what to feed into
    <DirectoryMatch> directives, in order to make the
    following plain-english ruleset work:

        1) If you receive a proxy request for
           http://foo.com/ -- proxy it, regardless of
           source.

        2) If you receive a proxy request for any host
           _other than_ http://foo.com -- refuse to proxy
           it, period.

    Now, I thought I had this licked by using these directives:

    <DirectoryMatch "^proxy:http://foo.com">
        Order deny,allow
        Allow from all
    </DirectoryMatch>

    <DirectoryMatch "^proxy:(?!http://foo.com)">
        Order allow,deny
        Deny from all
    </DirectoryMatch>

    In my world, the second directive would deny all
    requests that are not-foo-dot-com, and the first would
    allow all requests that are foo-dot-com, and there
    would be no problems, ever, for anything, since the
    two patterns would, at first blush, appear to be 
    mutually exclusive.

    Naturally, it's not working, and all proxy requests
    for all urls are getting allowed.

    What gives?  How can I make it work?

-- 
Fred Hicks <iago AT iago DOT net>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Proxying Problem: Need DirectoryMatch help!

[Iago <ia...@iago.net>]

  I think something on the order of this has managed to fix the problem.

  Thanks for lending weight to the 'never be afraid to ask' adage. :)

  I suspect I was diddling with the whole 'Order' directive a little
  too much.

  Anyway, the problem appears to be solved.  Appreciate it!

On Thu, 03 Oct 2002, Joshua Slive wrote:

> Apache 1.3 uses egrep/Posix-style regular expressions.  You appear to be 
> using a Perl regular expression (which is allowed in Apache 2.0).
> 
> But your problem should be relatively easy to solve.  I don't use the 
> proxy, so I can't test this, but I would think what you want is:
> 
> <Directory proxy:*>
> Order deny,allow
> deny from all
> </Directory>
> <Directory proxy:http://foo.com>
> Allow from all
> </Directory>

-- 
Fred Hicks <iago AT iago DOT net>

---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org

Re: [users@httpd] Proxying Problem: Need DirectoryMatch help!

[Joshua Slive <jo...@slive.ca>]

Iago wrote:

>     <DirectoryMatch "^proxy:http://foo.com">
>         Order deny,allow
>         Allow from all
>     </DirectoryMatch>
> 
>     <DirectoryMatch "^proxy:(?!http://foo.com)">
>         Order allow,deny
>         Deny from all
>     </DirectoryMatch>

Apache 1.3 uses egrep/Posix-style regular expressions.  You appear to be 
using a Perl regular expression (which is allowed in Apache 2.0).

But your problem should be relatively easy to solve.  I don't use the 
proxy, so I can't test this, but I would think what you want is:

<Directory proxy:*>
Order deny,allow
deny from all
</Directory>
<Directory proxy:http://foo.com>
Allow from all
</Directory>

Joshua.


---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
   "   from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org