You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by rj...@apache.org on 2012/07/22 13:44:23 UTC
svn commit: r1364266 - in /httpd/httpd/branches/2.4.x: ./ CHANGES STATUS
docs/manual/mod/mod_authz_core.xml modules/aaa/mod_authz_core.c
Author: rjung
Date: Sun Jul 22 11:44:23 2012
New Revision: 1364266
URL: http://svn.apache.org/viewvc?rev=1364266&view=rev
Log:
If an expression in "Require expr" returns denied and
references %{REMOTE_USER}, trigger authentication and retry.
Log error if 'Require expr' fails.
PR: 52892
Backport of r1351071, r1351072 and r1351074 from trunk.
Submitted by: sf
Reviewed by: rjung, trawick
Backported by: rjung
Modified:
httpd/httpd/branches/2.4.x/ (props changed)
httpd/httpd/branches/2.4.x/CHANGES
httpd/httpd/branches/2.4.x/STATUS
httpd/httpd/branches/2.4.x/docs/manual/mod/mod_authz_core.xml
httpd/httpd/branches/2.4.x/modules/aaa/mod_authz_core.c
Propchange: httpd/httpd/branches/2.4.x/
------------------------------------------------------------------------------
Merged /httpd/httpd/trunk:r1351071-1351072,1351074
Modified: httpd/httpd/branches/2.4.x/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/CHANGES?rev=1364266&r1=1364265&r2=1364266&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/CHANGES [utf-8] (original)
+++ httpd/httpd/branches/2.4.x/CHANGES [utf-8] Sun Jul 22 11:44:23 2012
@@ -8,6 +8,10 @@ Changes with Apache 2.4.3
possible XSS for a site where untrusted users can upload files to
a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]
+ *) mod_authz_core: If an expression in "Require expr" returns denied and
+ references %{REMOTE_USER}, trigger authentication and retry. PR 52892.
+ [Stefan Fritsch]
+
*) core: Always log if LimitRequestFieldSize triggers. [Stefan Fritsch]
*) mod_deflate: Skip compression if compression is enabled at SSL level.
Modified: httpd/httpd/branches/2.4.x/STATUS
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/STATUS?rev=1364266&r1=1364265&r2=1364266&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/STATUS (original)
+++ httpd/httpd/branches/2.4.x/STATUS Sun Jul 22 11:44:23 2012
@@ -88,15 +88,6 @@ RELEASE SHOWSTOPPERS:
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:
[ start all new proposals below, under PATCHES PROPOSED. ]
- * mod_authz_core: Allow to use %{REMOTE_USER} in Require expr. Improve
- logging.
- PR: 52892
- trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1351071
- http://svn.apache.org/viewvc?view=revision&revision=1351072
- http://svn.apache.org/viewvc?view=revision&revision=1351074
- 2.4.x patch: trunk patch works (ex. CHANGES)
- +1: sf, rjung, trawick
-
* mpm_event: Fix MaxConnectionsPerChild
trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1343085
http://svn.apache.org/viewvc?view=revision&revision=1343087
Modified: httpd/httpd/branches/2.4.x/docs/manual/mod/mod_authz_core.xml
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/docs/manual/mod/mod_authz_core.xml?rev=1364266&r1=1364265&r2=1364266&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/mod/mod_authz_core.xml (original)
+++ httpd/httpd/branches/2.4.x/docs/manual/mod/mod_authz_core.xml Sun Jul 22 11:44:23 2012
@@ -224,6 +224,11 @@ SetEnvIf User-Agent ^KnockKnock/2\.0 let
<p>The syntax is described in the <a href="../expr.html">ap_expr</a>
documentation.</p>
+ <p>Normally, the expression is evaluated before authentication. However, if
+ the expression returns false and references the variable
+ <code>%{REMOTE_USER}</code>, authentication will be performed and
+ the expression will be re-evaluated.</p>
+
</section>
Modified: httpd/httpd/branches/2.4.x/modules/aaa/mod_authz_core.c
URL: http://svn.apache.org/viewvc/httpd/httpd/branches/2.4.x/modules/aaa/mod_authz_core.c?rev=1364266&r1=1364265&r2=1364266&view=diff
==============================================================================
--- httpd/httpd/branches/2.4.x/modules/aaa/mod_authz_core.c (original)
+++ httpd/httpd/branches/2.4.x/modules/aaa/mod_authz_core.c Sun Jul 22 11:44:23 2012
@@ -1031,36 +1031,74 @@ static const authz_provider authz_method
&method_parse_config,
};
-static authz_status expr_check_authorization(request_rec *r,
- const char *require_line,
- const void *parsed_require_line)
-{
- const char *err = NULL;
- const ap_expr_info_t *expr = parsed_require_line;
- int rc = ap_expr_exec(r, expr, &err);
+/*
+ * expr authz provider
+ */
+
+#define REQUIRE_EXPR_NOTE "Require_expr_info"
+struct require_expr_info {
+ ap_expr_info_t *expr;
+ int want_user;
+};
- if (rc <= 0)
- /* XXX: real error handling? */
- return AUTHZ_DENIED;
- else
- return AUTHZ_GRANTED;
+static int expr_lookup_fn(ap_expr_lookup_parms *parms)
+{
+ if (parms->type == AP_EXPR_FUNC_VAR
+ && strcasecmp(parms->name, "REMOTE_USER") == 0) {
+ struct require_expr_info *info;
+ apr_pool_userdata_get((void**)&info, REQUIRE_EXPR_NOTE, parms->ptemp);
+ AP_DEBUG_ASSERT(info != NULL);
+ info->want_user = 1;
+ }
+ return ap_expr_lookup_default(parms);
}
static const char *expr_parse_config(cmd_parms *cmd, const char *require_line,
const void **parsed_require_line)
{
const char *expr_err = NULL;
- ap_expr_info_t *expr = ap_expr_parse_cmd(cmd, require_line, 0, &expr_err,
- NULL);
+ struct require_expr_info *info = apr_pcalloc(cmd->pool, sizeof(*info));
+
+ apr_pool_userdata_setn(info, REQUIRE_EXPR_NOTE, apr_pool_cleanup_null,
+ cmd->temp_pool);
+ info->expr = ap_expr_parse_cmd(cmd, require_line, 0, &expr_err,
+ expr_lookup_fn);
if (expr_err)
- return "Cannot parse expression in require line";
+ return apr_pstrcat(cmd->temp_pool,
+ "Cannot parse expression in require line: ",
+ expr_err, NULL);
- *parsed_require_line = expr;
+ *parsed_require_line = info;
return NULL;
}
+static authz_status expr_check_authorization(request_rec *r,
+ const char *require_line,
+ const void *parsed_require_line)
+{
+ const char *err = NULL;
+ const struct require_expr_info *info = parsed_require_line;
+ int rc = ap_expr_exec(r, info->expr, &err);
+
+ if (rc < 0) {
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02320)
+ "Error evaluating expression in 'Require expr': %s",
+ err);
+ return AUTHZ_GENERAL_ERROR;
+ }
+ else if (rc == 0) {
+ if (info->want_user)
+ return AUTHZ_DENIED_NO_USER;
+ else
+ return AUTHZ_DENIED;
+ }
+ else {
+ return AUTHZ_GRANTED;
+ }
+}
+
static const authz_provider authz_expr_provider =
{
&expr_check_authorization,