Clean up and remove dead code (ec859ea5) · Commits · CYBER - Cyber Security / TS 103 523 MSP / TLMSP / TLMSP Apache Httpd

include/http_core.h

+0 −31

Original line number	Diff line number	Diff line
		@@ -294,27 +294,6 @@ AP_DECLARE(const char ) ap_auth_type(request_rec r);
		*/
		AP_DECLARE(const char ) ap_auth_name(request_rec r);

		/**
		* How the requires lines must be met.
		* @param r The current request
		* @return How the requirements must be met. One of:
		* <pre>
		* SATISFY_ANY -- any of the requirements must be met.
		* SATISFY_ALL -- all of the requirements must be met.
		* SATISFY_NOSPEC -- There are no applicable satisfy lines
		* </pre>
		*
		AP_DE CLARE(int) ap_satisfies(request_rec *r);
		*/

		/**
		* Retrieve information about all of the requires directives for this request
		* @param r The current request
		* @return An array of all requires directives for this request
		*
		AP_DE CLARE(const apr_array_header_t ) ap_requires(request_rec r);
		*/

		#ifdef CORE_PRIVATE

		/**
		@@ -453,13 +432,6 @@ typedef struct {

		char *ap_default_type;

		// /* Authentication stuff. Groan... */
		//
		// int satisfy; / for every method one */
		// char ap_auth_type; / Deprecated see mod_authn */
		// char ap_auth_name; / Deprecated see mod_authn */
		// apr_array_header_t ap_requires; / Deprecated see mod_authz */

		/* Custom response config. These can contain text or a URL to redirect to.
		* if response_code_strings is NULL then there are none in the config,
		* if it's not null then it's allocated to sizeof(char)RESPONSE_CODES.
		@@ -687,9 +659,6 @@ APR_DECLARE_OPTIONAL_FN(const char *, ap_ident_lookup,
		* authorization values with mod_authz_host
		*/

		/APR_DECLARE_OPTIONAL_FN(const apr_array_header_t , authz_ap_requires,
		(request_rec *r));
		*/
		APR_DECLARE_OPTIONAL_FN(int, authz_some_auth_required, (request_rec *r));
		APR_DECLARE_OPTIONAL_FN(const char , authn_ap_auth_type, (request_rec r));
		APR_DECLARE_OPTIONAL_FN(const char , authn_ap_auth_name, (request_rec r));

modules/aaa/mod_auth_basic.c

+0 −4

Original line number	Diff line number	Diff line
		@@ -195,10 +195,6 @@ static int authenticate_basic_user(request_rec *r)
		return HTTP_INTERNAL_SERVER_ERROR;
		}

		/*XXX Need to figure out how to remove ap_auth_type from
		the request_rec yet still make the data available
		on a per-request basis.
		*/
		r->ap_auth_type = (char*)current_auth;

		res = get_basic_auth(r, &sent_user, &sent_pw);

modules/aaa/mod_authnz_ldap.c

+0 −375

Original line number	Diff line number	Diff line
		@@ -440,381 +440,6 @@ start_over:
		return AUTH_GRANTED;
		}

		#if 0
		/*
		* Authorisation Phase
		* -------------------
		*
		* After checking whether the username and password are correct, we need
		* to check whether that user is authorised to view this resource. The
		* require directive is used to do this:
		*
		* require valid-user Any authenticated is allowed in.
		* require user <username> This particular user is allowed in.
		* require group <groupname> The user must be a member of this group
		* in order to be allowed in.
		* require dn <dn> The user must have the following DN in the
		* LDAP tree to be let in.
		*
		*/
		static int authz_ldap_check_user_access(request_rec *r)
		{
		int result = 0;
		authn_ldap_request_t *req =
		(authn_ldap_request_t *)ap_get_module_config(r->request_config, &authnz_ldap_module);
		authn_ldap_config_t *sec =
		(authn_ldap_config_t *)ap_get_module_config(r->per_dir_config, &authnz_ldap_module);

		util_ldap_connection_t *ldc = NULL;
		int m = r->method_number;

		const apr_array_header_t *reqs_arr = ap_requires(r);
		require_line reqs = reqs_arr ? (require_line )reqs_arr->elts : NULL;

		register int x;
		const char *t;
		char w, value;
		int method_restricted = 0;

		char filtbuf[FILTER_LENGTH];
		const char *dn = NULL;
		const char **vals = NULL;

		/*
		if (!sec->enabled) {
		return DECLINED;
		}
		*/

		if (!sec->have_ldap_url) {
		return DECLINED;
		}

		if (sec->host) {
		ldc = util_ldap_connection_find(r, sec->host, sec->port,
		sec->binddn, sec->bindpw, sec->deref,
		sec->secure);
		apr_pool_cleanup_register(r->pool, ldc,
		authnz_ldap_cleanup_connection_close,
		apr_pool_cleanup_null);
		}
		else {
		ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: no sec->host - weird...?", getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}

		/*
		* If there are no elements in the group attribute array, the default should be
		* member and uniquemember; populate the array now.
		*/
		if (sec->groupattr->nelts == 0) {
		struct mod_auth_ldap_groupattr_entry_t *grp;
		#if APR_HAS_THREADS
		apr_thread_mutex_lock(sec->lock);
		#endif
		grp = apr_array_push(sec->groupattr);
		grp->name = "member";
		grp = apr_array_push(sec->groupattr);
		grp->name = "uniquemember";
		#if APR_HAS_THREADS
		apr_thread_mutex_unlock(sec->lock);
		#endif
		}

		if (!reqs_arr) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: no requirements array", getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}

		/*
		* If we have been authenticated by some other module than mod_auth_ldap,
		* the req structure needed for authorization needs to be created
		* and populated with the userid and DN of the account in LDAP
		*/

		/* Check that we have a userid to start with */
		if ((!r->user) \|\| (strlen(r->user) == 0)) {
		ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r,
		"ldap authorize: Userid is blank, AuthType=%s",
		r->ap_auth_type);
		}

		if(!req) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"ldap authorize: Creating LDAP req structure");

		/* Build the username filter */
		authn_ldap_build_filter(filtbuf, r, r->user, NULL, sec);

		/* Search for the user DN */
		result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,
		sec->scope, sec->attributes, filtbuf, &dn, &vals);

		/* Search failed, log error and return failure */
		if(result != LDAP_SUCCESS) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"auth_ldap authorise: User DN not found, %s", ldc->reason);
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}

		req = (authn_ldap_request_t *)apr_pcalloc(r->pool,
		sizeof(authn_ldap_request_t));
		ap_set_module_config(r->request_config, &authnz_ldap_module, req);
		req->dn = apr_pstrdup(r->pool, dn);
		req->user = r->user;
		}

		/* Loop through the requirements array until there's no elements
		* left, or something causes a return from inside the loop */
		for(x=0; x < reqs_arr->nelts; x++) {
		if (! (reqs[x].method_mask & (1 << m))) {
		continue;
		}
		method_restricted = 1;

		t = reqs[x].requirement;
		w = ap_getword_white(r->pool, &t);

		if (strcmp(w, "ldap-user") == 0) {
		if (req->dn == NULL \|\| strlen(req->dn) == 0) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require user: user's DN has not been defined; failing authorisation",
		getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}
		/*
		* First do a whole-line compare, in case it's something like
		* require user Babs Jensen
		*/
		result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, t);
		switch(result) {
		case LDAP_COMPARE_TRUE: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require user: authorisation successful", getpid());
		return OK;
		}
		default: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: require user: "
		"authorisation failed [%s][%s]", getpid(),
		ldc->reason, ldap_err2string(result));
		}
		}
		/*
		* Now break apart the line and compare each word on it
		*/
		while (t[0]) {
		w = ap_getword_conf(r->pool, &t);
		result = util_ldap_cache_compare(r, ldc, sec->url, req->dn, sec->attribute, w);
		switch(result) {
		case LDAP_COMPARE_TRUE: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require user: authorisation successful", getpid());
		return OK;
		}
		default: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require user: authorisation failed [%s][%s]",
		getpid(), ldc->reason, ldap_err2string(result));
		}
		}
		}
		}
		else if (strcmp(w, "ldap-dn") == 0) {
		if (req->dn == NULL \|\| strlen(req->dn) == 0) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require dn: user's DN has not been defined; failing authorisation",
		getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}

		result = util_ldap_cache_comparedn(r, ldc, sec->url, req->dn, t, sec->compare_dn_on_server);
		switch(result) {
		case LDAP_COMPARE_TRUE: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require dn: authorisation successful", getpid());
		return OK;
		}
		default: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require dn \"%s\": LDAP error [%s][%s]",
		getpid(), t, ldc->reason, ldap_err2string(result));
		}
		}
		}
		else if (strcmp(w, "ldap-group") == 0) {
		struct mod_auth_ldap_groupattr_entry_t ent = (struct mod_auth_ldap_groupattr_entry_t ) sec->groupattr->elts;
		int i;

		if (sec->group_attrib_is_dn) {
		if (req->dn == NULL \|\| strlen(req->dn) == 0) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: require group: "
		"user's DN has not been defined; failing authorisation",
		getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}
		}
		else {
		if (req->user == NULL \|\| strlen(req->user) == 0) {
		/* We weren't called in the authentication phase, so we didn't have a
		* chance to set the user field. Do so now. */
		req->user = r->user;
		}
		}

		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: require group: "
		"testing for group membership in \"%s\"",
		getpid(), t);

		for (i = 0; i < sec->groupattr->nelts; i++) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: require group: "
		"testing for %s: %s (%s)", getpid(),
		ent[i].name, sec->group_attrib_is_dn ? req->dn : req->user, t);

		result = util_ldap_cache_compare(r, ldc, sec->url, t, ent[i].name,
		sec->group_attrib_is_dn ? req->dn : req->user);
		switch(result) {
		case LDAP_COMPARE_TRUE: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: require group: "
		"authorisation successful (attribute %s) [%s][%s]",
		getpid(), ent[i].name, ldc->reason, ldap_err2string(result));
		return OK;
		}
		default: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: require group \"%s\": "
		"authorisation failed [%s][%s]",
		getpid(), t, ldc->reason, ldap_err2string(result));
		}
		}
		}
		}
		else if (strcmp(w, "ldap-attribute") == 0) {
		if (req->dn == NULL \|\| strlen(req->dn) == 0) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require ldap-attribute: user's DN has not been defined; failing authorisation",
		getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}
		while (t[0]) {
		w = ap_getword(r->pool, &t, '=');
		value = ap_getword_conf(r->pool, &t);

		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: checking attribute"
		" %s has value %s", getpid(), w, value);
		result = util_ldap_cache_compare(r, ldc, sec->url, req->dn,
		w, value);
		switch(result) {
		case LDAP_COMPARE_TRUE: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG,
		0, r, "[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require attribute: authorisation "
		"successful", getpid());
		return OK;
		}
		default: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG,
		0, r, "[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require attribute: authorisation "
		"failed [%s][%s]", getpid(),
		ldc->reason, ldap_err2string(result));
		}
		}
		}
		}
		else if (strcmp(w, "ldap-filter") == 0) {
		if (req->dn == NULL \|\| strlen(req->dn) == 0) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require ldap-filter: user's DN has not been defined; failing authorisation",
		getpid());
		return sec->auth_authoritative? HTTP_UNAUTHORIZED : DECLINED;
		}
		if (t[0]) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: checking filter %s",
		getpid(), t);

		/* Build the username filter */
		authn_ldap_build_filter(filtbuf, r, req->user, t, sec);

		/* Search for the user DN */
		result = util_ldap_cache_getuserdn(r, ldc, sec->url, sec->basedn,
		sec->scope, sec->attributes, filtbuf, &dn, &vals);

		/* Make sure that the filtered search returned the correct user dn */
		if (result == LDAP_SUCCESS) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: checking dn match %s",
		getpid(), dn);
		result = util_ldap_cache_comparedn(r, ldc, sec->url, req->dn, dn,
		sec->compare_dn_on_server);
		}

		switch(result) {
		case LDAP_COMPARE_TRUE: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG,
		0, r, "[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require ldap-filter: authorisation "
		"successful", getpid());
		return OK;
		}
		case LDAP_FILTER_ERROR: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG,
		0, r, "[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require ldap-filter: %s authorisation "
		"failed [%s][%s]", getpid(),
		filtbuf, ldc->reason, ldap_err2string(result));
		break;
		}
		default: {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG,
		0, r, "[%" APR_PID_T_FMT "] auth_ldap authorise: "
		"require ldap-filter: authorisation "
		"failed [%s][%s]", getpid(),
		ldc->reason, ldap_err2string(result));
		}
		}
		}
		}
		}

		if (!method_restricted) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: agreeing because non-restricted",
		getpid());
		return OK;
		}

		if (!sec->auth_authoritative) {
		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: declining to authorise", getpid());
		return DECLINED;
		}

		ap_log_rerror(APLOG_MARK, APLOG_DEBUG, 0, r,
		"[%" APR_PID_T_FMT "] auth_ldap authorise: authorisation denied", getpid());
		ap_note_basic_auth_failure (r);

		return HTTP_UNAUTHORIZED;
		}
		#endif

		static authz_status ldapuser_check_authorization(request_rec *r,
		const char *require_args)
		{

modules/aaa/mod_authz_dbd.c

+0 −60

Original line number	Diff line number	Diff line
		@@ -242,66 +242,6 @@ static int authz_dbd_group_query(request_rec r, authz_dbd_cfg cfg,
		return OK;
		}

		#if 0
		static int authz_dbd_check(request_rec *r)
		{
		int i, x, rv;
		const char *w;
		int m = r->method_number;
		const apr_array_header_t *reqs_arr = ap_requires(r);
		require_line reqs = reqs_arr ? (require_line ) reqs_arr->elts : NULL;
		apr_array_header_t *groups = NULL;
		const char *t;
		authz_dbd_cfg *cfg = ap_get_module_config(r->per_dir_config,
		&authz_dbd_module);

		if (!reqs_arr) {
		return DECLINED;
		}

		for (x = 0; x < reqs_arr->nelts; x++) {
		if (!(reqs[x].method_mask & (AP_METHOD_BIT << m))) {
		continue;
		}

		t = reqs[x].requirement;
		w = ap_getword_white(r->pool, &t);
		if (!strcasecmp(w, "dbd-group")) {
		if (groups == NULL) {
		groups = apr_array_make(r->pool, 4, sizeof(const char*));
		rv = authz_dbd_group_query(r, cfg, groups);
		if (rv != OK) {
		return rv;
		}
		}
		while (t[0]) {
		w = ap_getword_white(r->pool, &t);
		for (i=0; i < groups->nelts; ++i) {
		if (!strcmp(w, ((const char**)groups->elts)[i])) {
		return OK;
		}
		}
		}
		}
		else if (!strcasecmp(w, "dbd-login")) {
		return authz_dbd_login(r, cfg, "login");
		}
		else if (!strcasecmp(w, "dbd-logout")) {
		return authz_dbd_login(r, cfg, "logout");
		}
		}

		if ((groups != NULL) && cfg->authoritative) {
		ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,
		"authz_dbd: user %s denied access to %s",
		r->user, r->uri);
		ap_note_auth_failure(r);
		return HTTP_UNAUTHORIZED;
		}
		return DECLINED;
		}
		#endif

		static authz_status dbdgroup_check_authorization(request_rec *r,
		const char *require_args)
		{

modules/aaa/mod_authz_dbm.c

+0 −133

File changed.

Preview size limit exceeded, changes collapsed.