You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by ji...@apache.org on 2010/04/21 20:19:07 UTC
svn commit: r936407 - in /httpd/httpd/trunk: CHANGES
docs/manual/mod/mod_proxy_balancer.xml modules/proxy/mod_proxy_balancer.c
Author: jim
Date: Wed Apr 21 18:19:06 2010
New Revision: 936407
URL: http://svn.apache.org/viewvc?rev=936407&view=rev
Log:
Add in BalancerNonce directive... useful for shared-secrets.
Modified:
httpd/httpd/trunk/CHANGES
httpd/httpd/trunk/docs/manual/mod/mod_proxy_balancer.xml
httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c
Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=936407&r1=936406&r2=936407&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Wed Apr 21 18:19:06 2010
@@ -28,6 +28,10 @@ Changes with Apache 2.3.7
processing is completed, avoiding orphaned callback pointers.
[Brett Gervasoni <brettg senseofsecurity.com>, Jeff Trawick]
+ *) mod_proxy_balancer: Add new directive BalancerNonce to allow admin
+ to control/set the nonce used in the balancer-manager application.
+ [Jim Jagielski]
+
*) mod_proxy_connect: Support port ranges in AllowConnect. PR 23673.
[Stefan Fritsch]
Modified: httpd/httpd/trunk/docs/manual/mod/mod_proxy_balancer.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/docs/manual/mod/mod_proxy_balancer.xml?rev=936407&r1=936406&r2=936407&view=diff
==============================================================================
--- httpd/httpd/trunk/docs/manual/mod/mod_proxy_balancer.xml (original)
+++ httpd/httpd/trunk/docs/manual/mod/mod_proxy_balancer.xml Wed Apr 21 18:19:06 2010
@@ -183,4 +183,34 @@
<code>http://your.server.name/balancer-manager</code></p>
</section>
+<directivesynopsis>
+<name>BalancerNonce</name>
+<description>Set the nonce used in the balancer-manager application</description>
+<syntax>BalancerNonce Default|None|Set "value"</syntax>
+<default>ProxyStatus Default</default>
+<contextlist><context>server config</context>
+<context>virtual host</context>
+</contextlist>
+<compatibility>Available in version 2.4 and later</compatibility>
+
+<usage>
+ <p>This directive specifies the protective nonce used in the
+ <code>balancer-manager</code> application page.</p>
+ <p>The default is to use an automatically determined UUID-based
+ nonce, to provide for further protection for the page. If set
+ to <code>Set</code>, then the next argument sets the nonce to that
+ value. A setting of <code>None</code> disables all nonce checking.</p>
+
+ <example>
+ BalancerNonce Set "RealGudSharedSecret"
+ </example>
+
+ <note><title>Note</title>
+ <p>In addition to the nonce, the <code>balancer-manager</code> page
+ should be protected via an ACL.</p>
+ </note>
+
+</usage>
+</directivesynopsis>
+
</modulesynopsis>
Modified: httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c?rev=936407&r1=936406&r2=936407&view=diff
==============================================================================
--- httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c (original)
+++ httpd/httpd/trunk/modules/proxy/mod_proxy_balancer.c Wed Apr 21 18:19:06 2010
@@ -659,23 +659,12 @@ static void recalc_factors(proxy_balance
}
}
-/* post_config hook: */
-static int balancer_init(apr_pool_t *p, apr_pool_t *plog,
- apr_pool_t *ptemp, server_rec *s)
+/* pre_config hook: */
+static int balancer_init(apr_pool_t *pconf, apr_pool_t *plog,
+ apr_pool_t *ptemp)
{
- void *data;
- const char *userdata_key = "mod_proxy_balancer_init";
apr_uuid_t uuid;
- /* balancer_init() will be called twice during startup. So, only
- * set up the static data the second time through. */
- apr_pool_userdata_get(&data, userdata_key, s->process->pool);
- if (!data) {
- apr_pool_userdata_set((const void *)1, userdata_key,
- apr_pool_cleanup_null, s->process->pool);
- return OK;
- }
-
/* Retrieve a UUID and store the nonce for the lifetime of
* the process. */
apr_uuid_get(&uuid);
@@ -730,8 +719,9 @@ static int balancer_handler(request_rec
/* Check that the supplied nonce matches this server's nonce;
* otherwise ignore all parameters, to prevent a CSRF attack. */
- if ((name = apr_table_get(params, "nonce")) == NULL
- || strcmp(balancer_nonce, name) != 0) {
+ if (*balancer_nonce &&
+ ((name = apr_table_get(params, "nonce")) == NULL
+ || strcmp(balancer_nonce, name) != 0)) {
apr_table_clear(params);
}
@@ -972,6 +962,35 @@ static void child_init(apr_pool_t *p, se
}
+static const char *set_balancer_nonce (cmd_parms *cmd, void *dummy, const char *arg,
+ const char *val)
+{
+ const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
+ if (err != NULL) {
+ return err;
+ }
+
+ if (!strcasecmp(arg, "None")) {
+ *balancer_nonce = '\0';
+ } else if (!strcasecmp(arg, "Set")) {
+ if (val) {
+ apr_cpystrn(balancer_nonce, val, sizeof(balancer_nonce));
+ } else {
+ return "BalancerNonce Set requires an argument";
+ }
+ } else if (strcasecmp(arg, "Default")) {
+ return "Bad argument for BalancerNonce: Must be 'Set', 'None' or 'Default'";
+ }
+ return NULL;
+}
+
+static const command_rec balancer_cmds[] =
+{
+ AP_INIT_TAKE12("BalancerNonce", set_balancer_nonce, NULL,
+ RSRC_CONF, "Set value for balancer-manager nonce"),
+ {NULL}
+};
+
static void ap_proxy_balancer_register_hook(apr_pool_t *p)
{
/* Only the mpm_winnt has child init hook handler.
@@ -980,7 +999,7 @@ static void ap_proxy_balancer_register_h
*/
static const char *const aszPred[] = { "mpm_winnt.c", NULL};
/* manager handler */
- ap_hook_post_config(balancer_init, NULL, NULL, APR_HOOK_MIDDLE);
+ ap_hook_pre_config(balancer_init, NULL, NULL, APR_HOOK_MIDDLE);
ap_hook_handler(balancer_handler, NULL, NULL, APR_HOOK_FIRST);
ap_hook_child_init(child_init, aszPred, NULL, APR_HOOK_MIDDLE);
proxy_hook_pre_request(proxy_balancer_pre_request, NULL, NULL, APR_HOOK_FIRST);
@@ -994,6 +1013,6 @@ module AP_MODULE_DECLARE_DATA proxy_bala
NULL, /* merge per-directory config structures */
NULL, /* create per-server config structure */
NULL, /* merge per-server config structures */
- NULL, /* command apr_table_t */
+ balancer_cmds, /* command apr_table_t */
ap_proxy_balancer_register_hook /* register hooks */
};