You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
175 lines
6.1 KiB
175 lines
6.1 KiB
Index: server/request.c |
|
=================================================================== |
|
--- a/server/request.c (revision 1684524) |
|
+++ b/server/request.c (revision 1684525) |
|
@@ -71,6 +71,7 @@ |
|
APR_HOOK_LINK(create_request) |
|
APR_HOOK_LINK(post_perdir_config) |
|
APR_HOOK_LINK(dirwalk_stat) |
|
+ APR_HOOK_LINK(force_authn) |
|
) |
|
|
|
AP_IMPLEMENT_HOOK_RUN_FIRST(int,translate_name, |
|
@@ -97,6 +98,8 @@ |
|
AP_IMPLEMENT_HOOK_RUN_FIRST(apr_status_t,dirwalk_stat, |
|
(apr_finfo_t *finfo, request_rec *r, apr_int32_t wanted), |
|
(finfo, r, wanted), AP_DECLINED) |
|
+AP_IMPLEMENT_HOOK_RUN_FIRST(int,force_authn, |
|
+ (request_rec *r), (r), DECLINED) |
|
|
|
static int auth_internal_per_conf = 0; |
|
static int auth_internal_per_conf_hooks = 0; |
|
@@ -118,6 +121,39 @@ |
|
} |
|
} |
|
|
|
+AP_DECLARE(int) ap_some_authn_required(request_rec *r) |
|
+{ |
|
+ int access_status; |
|
+ |
|
+ switch (ap_satisfies(r)) { |
|
+ case SATISFY_ALL: |
|
+ case SATISFY_NOSPEC: |
|
+ if ((access_status = ap_run_access_checker(r)) != OK) { |
|
+ break; |
|
+ } |
|
+ |
|
+ access_status = ap_run_access_checker_ex(r); |
|
+ if (access_status == DECLINED) { |
|
+ return TRUE; |
|
+ } |
|
+ |
|
+ break; |
|
+ case SATISFY_ANY: |
|
+ if ((access_status = ap_run_access_checker(r)) == OK) { |
|
+ break; |
|
+ } |
|
+ |
|
+ access_status = ap_run_access_checker_ex(r); |
|
+ if (access_status == DECLINED) { |
|
+ return TRUE; |
|
+ } |
|
+ |
|
+ break; |
|
+ } |
|
+ |
|
+ return FALSE; |
|
+} |
|
+ |
|
/* This is the master logic for processing requests. Do NOT duplicate |
|
* this logic elsewhere, or the security model will be broken by future |
|
* API changes. Each phase must be individually optimized to pick up |
|
@@ -232,15 +268,8 @@ |
|
} |
|
|
|
access_status = ap_run_access_checker_ex(r); |
|
- if (access_status == OK) { |
|
- ap_log_rerror(APLOG_MARK, APLOG_TRACE3, 0, r, |
|
- "request authorized without authentication by " |
|
- "access_checker_ex hook: %s", r->uri); |
|
- } |
|
- else if (access_status != DECLINED) { |
|
- return decl_die(access_status, "check access", r); |
|
- } |
|
- else { |
|
+ if (access_status == DECLINED |
|
+ || (access_status == OK && ap_run_force_authn(r) == OK)) { |
|
if ((access_status = ap_run_check_user_id(r)) != OK) { |
|
return decl_die(access_status, "check user", r); |
|
} |
|
@@ -258,6 +287,14 @@ |
|
return decl_die(access_status, "check authorization", r); |
|
} |
|
} |
|
+ else if (access_status == OK) { |
|
+ ap_log_rerror(APLOG_MARK, APLOG_TRACE3, 0, r, |
|
+ "request authorized without authentication by " |
|
+ "access_checker_ex hook: %s", r->uri); |
|
+ } |
|
+ else { |
|
+ return decl_die(access_status, "check access", r); |
|
+ } |
|
break; |
|
case SATISFY_ANY: |
|
if ((access_status = ap_run_access_checker(r)) == OK) { |
|
@@ -269,15 +306,8 @@ |
|
} |
|
|
|
access_status = ap_run_access_checker_ex(r); |
|
- if (access_status == OK) { |
|
- ap_log_rerror(APLOG_MARK, APLOG_TRACE3, 0, r, |
|
- "request authorized without authentication by " |
|
- "access_checker_ex hook: %s", r->uri); |
|
- } |
|
- else if (access_status != DECLINED) { |
|
- return decl_die(access_status, "check access", r); |
|
- } |
|
- else { |
|
+ if (access_status == DECLINED |
|
+ || (access_status == OK && ap_run_force_authn(r) == OK)) { |
|
if ((access_status = ap_run_check_user_id(r)) != OK) { |
|
return decl_die(access_status, "check user", r); |
|
} |
|
@@ -295,6 +325,14 @@ |
|
return decl_die(access_status, "check authorization", r); |
|
} |
|
} |
|
+ else if (access_status == OK) { |
|
+ ap_log_rerror(APLOG_MARK, APLOG_TRACE3, 0, r, |
|
+ "request authorized without authentication by " |
|
+ "access_checker_ex hook: %s", r->uri); |
|
+ } |
|
+ else { |
|
+ return decl_die(access_status, "check access", r); |
|
+ } |
|
break; |
|
} |
|
} |
|
Index: include/http_request.h |
|
=================================================================== |
|
--- a/include/http_request.h (revision 1684524) |
|
+++ b/include/http_request.h (revision 1684525) |
|
@@ -185,6 +185,8 @@ |
|
* is required for the current request |
|
* @param r The current request |
|
* @return 1 if authentication is required, 0 otherwise |
|
+ * @bug Behavior changed in 2.4.x refactoring, API no longer usable |
|
+ * @deprecated @see ap_some_authn_required() |
|
*/ |
|
AP_DECLARE(int) ap_some_auth_required(request_rec *r); |
|
|
|
@@ -539,6 +541,16 @@ |
|
AP_DECLARE_HOOK(int,post_perdir_config,(request_rec *r)) |
|
|
|
/** |
|
+ * This hook allows a module to force authn to be required when |
|
+ * processing a request. |
|
+ * This hook should be registered with ap_hook_force_authn(). |
|
+ * @param r The current request |
|
+ * @return OK (force authn), DECLINED (let later modules decide) |
|
+ * @ingroup hooks |
|
+ */ |
|
+AP_DECLARE_HOOK(int,force_authn,(request_rec *r)) |
|
+ |
|
+/** |
|
* This hook allows modules to handle/emulate the apr_stat() calls |
|
* needed for directory walk. |
|
* @param r The current request |
|
@@ -584,6 +596,17 @@ |
|
AP_DECLARE(apr_bucket *) ap_bucket_eor_create(apr_bucket_alloc_t *list, |
|
request_rec *r); |
|
|
|
+/** |
|
+ * Can be used within any handler to determine if any authentication |
|
+ * is required for the current request. Note that if used with an |
|
+ * access_checker hook, an access_checker_ex hook or an authz provider; the |
|
+ * caller should take steps to avoid a loop since this function is |
|
+ * implemented by calling these hooks. |
|
+ * @param r The current request |
|
+ * @return TRUE if authentication is required, FALSE otherwise |
|
+ */ |
|
+AP_DECLARE(int) ap_some_authn_required(request_rec *r); |
|
+ |
|
#ifdef __cplusplus |
|
} |
|
#endif
|
|
|