You are viewing a plain text version of this content. The canonical link for it is here.
Posted to docs@httpd.apache.org by Joshua Slive <sl...@finance.commerce.ubc.ca> on 2000/09/26 03:46:32 UTC
Order Mutual-failure
I've never been able to figure this out either. What the heck is
"Order Mutual-failure" supposed to do?
From: lbayuk@mindspring.com (ljb)
Newsgroups: comp.infosystems.www.servers.unix
Subject: Apache "Order Allow,Deny" vs "Order Mutual-failure"?
Date: 26 Sep 2000 01:15:32 GMT
Organization: MindSpring Enterprises
Lines: 26
Message-ID: <8q...@slb2.atl.mindspring.net>
NNTP-Posting-Host: 04.36.29.10
X-no-archive: yes
User-Agent: slrn/0.9.5.4 (UNIX)
After reading the Apache documentation (and the O'Reilly book, and another
book on security) I was still really confused about the 3 choices for
"Order" in Allow /Deny access rules. So I looked at the source, and now it
seems to me the documentation is wrong, and "Order Allow,Deny" is exactly
the same as "Order Mutual-failure". Look at this summary of the code in
mod_access.c (Apache 1.3.12) check_dir_access(), and tell me if I'm wrong.
if (a->order[method] == ALLOW_THEN_DENY) {
ret = FORBIDDEN;
if (find_allowdeny(r, a->allows, method)) ret = OK;
if (find_allowdeny(r, a->denys, method)) ret = FORBIDDEN;
}
...
else /* (a->order[method] == MUTUAL_FAILURE) */ {
if (find_allowdeny(r, a->allows, method)
&& !find_allowdeny(r, a->denys, method))
ret = OK;
else
ret = FORBIDDEN;
}
To me, both cases above (ALLOW_THEN_DENY and MUTUAL_FAILURE) result
in the exact same value of "ret" for any set of returns from
find_allowdeny(). Am I wrong? Can someone show me a case where
"Order Allow,Deny" differs from "Order Mutual-failure"?
Re: Order Mutual-failure
Posted by Kevin Dart <kd...@lineone.net>.
unsubscribe
----- Original Message -----
From: "Joshua Slive" <sl...@finance.commerce.ubc.ca>
To: <ap...@apache.org>
Sent: Thursday, September 28, 2000 9:15 PM
Subject: Re: Order Mutual-failure
> On Thu, 28 Sep 2000, Raymond S Brand wrote:
>
> > Please do not not delete documentation for existing directives. Instead,
> > annotate the existing documentation with a note that the documentor does
> > not understand what and/or how the directives work. Hopefully, someone
> > will read the note and correct the situation with better documentation
> > (and maybe code).
> >
> > Hidden features are a bad idea.
>
> Okay. I see your (and Ken's) point. I promise not to go
> delete all the documentation I don't understand. (That might lead to a
> considerably smaller set of docs!)
>
> Joshua.
>
>
Re: Order Mutual-failure
Posted by Joshua Slive <sl...@finance.commerce.ubc.ca>.
On Thu, 28 Sep 2000, Raymond S Brand wrote:
> Please do not not delete documentation for existing directives. Instead,
> annotate the existing documentation with a note that the documentor does
> not understand what and/or how the directives work. Hopefully, someone
> will read the note and correct the situation with better documentation
> (and maybe code).
>
> Hidden features are a bad idea.
Okay. I see your (and Ken's) point. I promise not to go
delete all the documentation I don't understand. (That might lead to a
considerably smaller set of docs!)
Joshua.
Re: Order Mutual-failure
Posted by Raymond S Brand <rs...@gate.net>.
Please do not not delete documentation for existing directives. Instead,
annotate the existing documentation with a note that the documentor does
not understand what and/or how the directives work. Hopefully, someone
will read the note and correct the situation with better documentation
(and maybe code).
Hidden features are a bad idea.
Raymond S Brand
Joshua Slive wrote:
>
> On Thu, 28 Sep 2000, Rich Bowen wrote:
>
> > Joshua Slive wrote:
> > >
> > > I've never been able to figure this out either. What the heck is
> > > "Order Mutual-failure" supposed to do?
> >
> > Seems to me there was a good use I had for this at one point. I'll have
> > to go back through my notes.
> >
>
> Well, if you figure out anyting, please let me know. Otherwise, my hand
> is itching towards the delete key as we speak.
>
> Joshua.
Re: Order Mutual-failure
Posted by Rodent of Unusual Size <Ke...@Golux.Com>.
Joshua Slive wrote:
>
> Well, if you figure out anyting, please let me know. Otherwise,
> my hand is itching towards the delete key as we speak.
Um, no deleting of documentation for existing features.
Mark it as deprecated or confusing, but don't delete it.
Actually, I had the impression that wildcards were treated
differently for Mutual-Failure, but I can't support it now.
--
#ken P-)}
Ken Coar <http://Golux.Com/coar/>
Apache Software Foundation <http://www.apache.org/>
"Apache Server for Dummies" <http://Apache-Server.Com/>
"Apache Server Unleashed" <http://ApacheUnleashed.Com/>
Re: Order Mutual-failure
Posted by Joshua Slive <sl...@finance.commerce.ubc.ca>.
On Thu, 28 Sep 2000, Rich Bowen wrote:
> Joshua Slive wrote:
> >
> > I've never been able to figure this out either. What the heck is
> > "Order Mutual-failure" supposed to do?
>
> Seems to me there was a good use I had for this at one point. I'll have
> to go back through my notes.
>
Well, if you figure out anyting, please let me know. Otherwise, my hand
is itching towards the delete key as we speak.
Joshua.
Re: Order Mutual-failure
Posted by Rich Bowen <rb...@rcbowen.com>.
Joshua Slive wrote:
>
> I've never been able to figure this out either. What the heck is
> "Order Mutual-failure" supposed to do?
As far as I've been able to tell, mutual-failure means that a host, in
order to be allowed, must BOTH appear on the allow list, and not appear
on the deny list. Which seems pretty stupid, now that I've written it
out, because that's pretty much what you'd get if you did an Order
Allow,Deny
Seems to me there was a good use I had for this at one point. I'll have
to go back through my notes.
Hmm.
Rich
Re: Order Mutual-failure
Posted by Tony Finch <do...@dotat.at>.
Joshua Slive <sl...@finance.commerce.ubc.ca> wrote:
>
>Well, I'm tempted to nuke it from the documentation, at least.
>It confuses me, and obviously other people too.
I agree, mutual-failure is bogus.
Tony.
--
en oeccget g mtcaa f.a.n.finch
v spdlkishrhtewe y dot@dotat.at
eatp o v eiti i d. fanf@covalent.net
Re: Order Mutual-failure
Posted by Joshua Slive <sl...@finance.commerce.ubc.ca>.
On Wed, 27 Sep 2000, Tony Finch wrote:
> Joshua Slive <sl...@finance.commerce.ubc.ca> wrote:
> >
> >I've never been able to figure this out either. What the heck is
> >"Order Mutual-failure" supposed to do?
>
> Dunno. It's really old code, though, so the CVS archive isn't much help.
>
Well, I'm tempted to nuke it from the documentation, at least.
It confuses me, and obviously other people too.
--
Joshua Slive
slive@finance.commerce.ubc.ca
http://finance.commerce.ubc.ca/~slive/
Phone: (604) 822-1871
Re: Order Mutual-failure
Posted by Tony Finch <do...@dotat.at>.
Joshua Slive <sl...@finance.commerce.ubc.ca> wrote:
>
>I've never been able to figure this out either. What the heck is
>"Order Mutual-failure" supposed to do?
Dunno. It's really old code, though, so the CVS archive isn't much help.
Tony.
--
en oeccget g mtcaa f.a.n.finch
v spdlkishrhtewe y dot@dotat.at
eatp o v eiti i d. fanf@covalent.net