work out a few more bugs and now it works. Still needs some clean up and the... (24d877a9) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

modules/aaa/mod_auth.h

+8 −1

Original line number	Diff line number	Diff line
		@@ -51,6 +51,13 @@ typedef enum {
		AUTH_GENERAL_ERROR
		} authn_status;

		typedef enum {
		AUTHZ_DENIED,
		AUTHZ_DECLINED,
		AUTHZ_GRANTED,
		AUTHZ_GENERAL_ERROR
		} authz_status;

		typedef struct {
		/* Given a username and password, expected to return AUTH_GRANTED
		* if we can validate this user/password combination.
		@@ -78,7 +85,7 @@ typedef struct {
		/* Given a request_rec, expected to return AUTH_GRANTED
		* if we can authorize user access.
		*/
		authn_status (check_authorization)(request_rec r, apr_int64_t method_mask, const char *require_line);
		authz_status (check_authorization)(request_rec r, apr_int64_t method_mask, const char *require_line);
		} authz_provider;

		/* A linked-list of authn providers. */

modules/aaa/mod_authz_host.c

+10 −9

Original line number	Diff line number	Diff line
		@@ -431,7 +431,7 @@ static int authorize_user(request_rec *r)
		{
		authz_host_dir_conf *conf = ap_get_module_config(r->per_dir_config,
		&authz_host_module);
		authn_status auth_result;
		authz_status auth_result;
		authz_provider_list *current_provider;

		current_provider = conf->providers;
		@@ -448,7 +448,7 @@ static int authorize_user(request_rec *r)
		if (!provider \|\| !provider->check_authorization) {
		ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
		"No Authz provider configured");
		auth_result = AUTH_GENERAL_ERROR;
		auth_result = AUTHZ_GENERAL_ERROR;
		break;
		}
		apr_table_setn(r->notes, AUTHZ_PROVIDER_NAME_NOTE, AUTHZ_DEFAULT_PROVIDER);
		@@ -464,7 +464,7 @@ static int authorize_user(request_rec *r)
		apr_table_unset(r->notes, AUTHZ_PROVIDER_NAME_NOTE);

		/* Something occured. Stop checking. */
		if (auth_result != AUTH_DENIED) {
		if (auth_result != AUTHZ_DENIED) {
		break;
		}

		@@ -476,7 +476,7 @@ static int authorize_user(request_rec *r)
		current_provider = current_provider->next;
		} while (current_provider);

		if (auth_result != AUTH_GRANTED) {
		if (auth_result != AUTHZ_GRANTED) {
		int return_code;

		/* XXX need to deal with DECLINED vs DENIED. DECLINED may not even
		@@ -485,13 +485,13 @@ static int authorize_user(request_rec *r)
		according to the order and the Authz_xxx_Authoritative directives.
		*/
		switch (auth_result) {
		case AUTH_DENIED:
		case AUTHZ_DENIED:
		ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
		"user %s: authorization failure for \"%s\": ",
		r->user, r->uri);
		return_code = HTTP_UNAUTHORIZED;
		break;
		case AUTH_GENERAL_ERROR:
		case AUTHZ_GENERAL_ERROR:
		default:
		/* We'll assume that the module has already said what its error
		* was in the logs.
		@@ -535,15 +535,16 @@ static int authz_some_auth_required(request_rec *r)
		* provider.
		*/
		if (!current_provider) {
		provider = ap_lookup_provider(AUTHZ_PROVIDER_GROUP,
		/* provider = ap_lookup_provider(AUTHZ_PROVIDER_GROUP,
		AUTHZ_DEFAULT_PROVIDER, "0");

		if (!provider \|\| !provider->check_authorization) {
		ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
		"No Authz providers configured. Assmuming no authorization required.");
		*/
		req_authz = 0;
		break;
		}
		/* }*/
		}
		else {
		provider = current_provider->provider;
		@@ -600,7 +601,7 @@ module AP_MODULE_DECLARE_DATA authz_host_module =
		{
		STANDARD20_MODULE_STUFF,
		create_authz_host_dir_config, /* dir config creater */
		merge_authz_host_dir_config, /* dir merger --- default is to override */
		NULL, /* dir merger --- default is to override */
		NULL, /* server config */
		NULL, /* merge server config */
		authz_host_cmds,

modules/aaa/mod_authz_user.c

+7 −7

Original line number	Diff line number	Diff line
		@@ -117,14 +117,14 @@ static int check_user_access(request_rec *r)
		}
		#endif

		static authn_status user_check_authorization(request_rec r, apr_int64_t method_mask, const char require_line)
		static authz_status user_check_authorization(request_rec r, apr_int64_t method_mask, const char require_line)
		{
		char *user = r->user;
		int m = r->method_number;
		const char t, w;

		if (!(method_mask & (AP_METHOD_BIT << m))) {
		return DECLINED;
		return AUTHZ_DECLINED;
		}

		t = require_line;
		@@ -136,7 +136,7 @@ static authn_status user_check_authorization(request_rec *r, apr_int64_t method_
		while (t[0]) {
		w = ap_getword_conf(r->pool, &t);
		if (!strcmp(user, w)) {
		return OK;
		return AUTHZ_GRANTED;
		}
		}
		}
		@@ -147,17 +147,17 @@ static authn_status user_check_authorization(request_rec *r, apr_int64_t method_
		r->uri, user);

		ap_note_auth_failure(r);
		return HTTP_UNAUTHORIZED;
		return AUTHZ_GENERAL_ERROR;
		}

		static authn_status validuser_check_authorization(request_rec r, apr_int64_t method_mask, const char require_line)
		static authz_status validuser_check_authorization(request_rec r, apr_int64_t method_mask, const char require_line)
		{
		int m = r->method_number;

		if (!(method_mask & (AP_METHOD_BIT << m))) {
		return DECLINED;
		return AUTHZ_DECLINED;
		}
		return OK;
		return AUTHZ_GRANTED;
		}

		static const authz_provider authz_user_provider =

server/core.c

+8 −0

Original line number	Diff line number	Diff line
		@@ -268,6 +268,14 @@ static void merge_core_dir_configs(apr_pool_t a, void basev, void newv)
		conf->ap_default_type = new->ap_default_type;
		}

		if (new->ap_auth_type) {
		conf->ap_auth_type = new->ap_auth_type;
		}

		if (new->ap_auth_name) {
		conf->ap_auth_name = new->ap_auth_name;
		}

		if (conf->response_code_strings == NULL) {
		conf->response_code_strings = new->response_code_strings;
		}