Adding upstream version 2.4.57.upstream/2.4.57

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

1 files changed, 1173 insertions, 0 deletions

diff --git a/modules/aaa/mod_authz_core.c b/modules/aaa/mod_authz_core.c
new file mode 100644
index 0000000..40e5fe1
--- /dev/null
+++ b/modules/aaa/mod_authz_core.c
@@ -0,0 +1,1173 @@
+/* Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * Security options etc.
+ *
+ * Module derived from code originally written by Rob McCool
+ *
+ */
+
+#include "apr_strings.h"
+#include "apr_network_io.h"
+#include "apr_md5.h"
+
+#define APR_WANT_STRFUNC
+#define APR_WANT_BYTEFUNC
+#include "apr_want.h"
+
+#include "ap_config.h"
+#include "httpd.h"
+#include "http_config.h"
+#include "http_core.h"
+#include "http_log.h"
+#include "http_request.h"
+#include "http_protocol.h"
+#include "ap_provider.h"
+#include "ap_expr.h"
+
+#include "mod_auth.h"
+
+#if APR_HAVE_NETINET_IN_H
+#include <netinet/in.h>
+#endif
+
+#undef AUTHZ_EXTRA_CONFIGS
+
+typedef struct provider_alias_rec {
+    char *provider_name;
+    char *provider_alias;
+    char *provider_args;
+    const void *provider_parsed_args;
+    ap_conf_vector_t *sec_auth;
+    const authz_provider *provider;
+} provider_alias_rec;
+
+typedef enum {
+    AUTHZ_LOGIC_AND,
+    AUTHZ_LOGIC_OR,
+    AUTHZ_LOGIC_OFF,
+    AUTHZ_LOGIC_UNSET
+} authz_logic_op;
+
+typedef struct authz_section_conf authz_section_conf;
+
+struct authz_section_conf {
+    const char *provider_name;
+    const char *provider_args;
+    const void *provider_parsed_args;
+    const authz_provider *provider;
+    apr_int64_t limited;
+    authz_logic_op op;
+    int negate;
+    /** true if this is not a real container but produced by AuthMerging;
+     *  only used for logging */
+    int is_merged;
+    authz_section_conf *first;
+    authz_section_conf *next;
+};
+
+typedef struct authz_core_dir_conf authz_core_dir_conf;
+
+struct authz_core_dir_conf {
+    authz_section_conf *section;
+    authz_core_dir_conf *next;
+    authz_logic_op op;
+    signed char authz_forbidden_on_fail;
+};
+
+#define UNSET -1
+
+typedef struct authz_core_srv_conf {
+    apr_hash_t *alias_rec;
+} authz_core_srv_conf;
+
+module AP_MODULE_DECLARE_DATA authz_core_module;
+
+static authz_core_dir_conf *authz_core_first_dir_conf;
+
+static void *create_authz_core_dir_config(apr_pool_t *p, char *dummy)
+{
+    authz_core_dir_conf *conf = apr_pcalloc(p, sizeof(*conf));
+
+    conf->op = AUTHZ_LOGIC_UNSET;
+    conf->authz_forbidden_on_fail = UNSET;
+
+    conf->next = authz_core_first_dir_conf;
+    authz_core_first_dir_conf = conf;
+
+    return (void *)conf;
+}
+
+static void *merge_authz_core_dir_config(apr_pool_t *p,
+                                         void *basev, void *newv)
+{
+    authz_core_dir_conf *base = (authz_core_dir_conf *)basev;
+    authz_core_dir_conf *new = (authz_core_dir_conf *)newv;
+    authz_core_dir_conf *conf;
+
+    if (new->op == AUTHZ_LOGIC_UNSET && !new->section && base->section ) {
+        /* Only authz_forbidden_on_fail has been set in new. Don't treat
+         * it as a new auth config w.r.t. AuthMerging */
+        conf = apr_pmemdup(p, base, sizeof(*base));
+    }
+    else if (new->op == AUTHZ_LOGIC_OFF || new->op == AUTHZ_LOGIC_UNSET ||
+             !(base->section || new->section)) {
+        conf = apr_pmemdup(p, new, sizeof(*new));
+    }
+    else {
+        authz_section_conf *section;
+
+        if (base->section) {
+            if (new->section) {
+                section = apr_pcalloc(p, sizeof(*section));
+
+                section->limited =
+                    base->section->limited | new->section->limited;
+
+                section->op = new->op;
+                section->is_merged = 1;
+
+                section->first = apr_pmemdup(p, base->section,
+                                             sizeof(*base->section));
+                section->first->next = apr_pmemdup(p, new->section,
+                                                   sizeof(*new->section));
+            } else {
+                section = apr_pmemdup(p, base->section,
+                                      sizeof(*base->section));
+            }
+        }
+        else {
+            section = apr_pmemdup(p, new->section, sizeof(*new->section));
+        }
+
+        conf = apr_pcalloc(p, sizeof(*conf));
+
+        conf->section = section;
+        conf->op = new->op;
+    }
+
+    if (new->authz_forbidden_on_fail == UNSET)
+        conf->authz_forbidden_on_fail = base->authz_forbidden_on_fail;
+    else
+        conf->authz_forbidden_on_fail = new->authz_forbidden_on_fail;
+
+    return (void*)conf;
+}
+
+/* Only per-server directive we have is GLOBAL_ONLY */
+static void *merge_authz_core_svr_config(apr_pool_t *p,
+                                         void *basev, void *newv)
+{
+    return basev;
+}
+
+static void *create_authz_core_svr_config(apr_pool_t *p, server_rec *s)
+{
+    authz_core_srv_conf *authcfg;
+
+    authcfg = apr_pcalloc(p, sizeof(*authcfg));
+    authcfg->alias_rec = apr_hash_make(p);
+
+    return (void *)authcfg;
+}
+
+/* This is a fake authz provider that really merges various authz alias
+ * configurations and then invokes them.
+ */
+static authz_status authz_alias_check_authorization(request_rec *r,
+                                                    const char *require_args,
+                                                    const void *parsed_require_args)
+{
+    const char *provider_name;
+
+    /* Look up the provider alias in the alias list.
+     * Get the dir_config and call ap_merge_per_dir_configs()
+     * Call the real provider->check_authorization() function
+     * Return the result of the above function call
+     */
+
+    provider_name = apr_table_get(r->notes, AUTHZ_PROVIDER_NAME_NOTE);
+
+    if (provider_name) {
+        authz_core_srv_conf *authcfg;
+        provider_alias_rec *prvdraliasrec;
+
+        authcfg = ap_get_module_config(r->server->module_config,
+                                       &authz_core_module);
+
+        prvdraliasrec = apr_hash_get(authcfg->alias_rec, provider_name,
+                                     APR_HASH_KEY_STRING);
+
+        /* If we found the alias provider in the list, then merge the directory
+           configurations and call the real provider */
+        if (prvdraliasrec) {
+            ap_conf_vector_t *orig_dir_config = r->per_dir_config;
+            authz_status ret;
+
+            r->per_dir_config =
+                ap_merge_per_dir_configs(r->pool, orig_dir_config,
+                                         prvdraliasrec->sec_auth);
+
+            ret = prvdraliasrec->provider->
+                check_authorization(r, prvdraliasrec->provider_args,
+                                    prvdraliasrec->provider_parsed_args);
+
+            r->per_dir_config = orig_dir_config;
+
+            return ret;
+        }
+    }
+
+    ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02305)
+                  "no alias provider found for '%s' (BUG?)",
+                  provider_name ? provider_name : "n/a");
+
+    return AUTHZ_DENIED;
+}
+
+static const authz_provider authz_alias_provider =
+{
+    &authz_alias_check_authorization,
+    NULL,
+};
+
+static const char *authz_require_alias_section(cmd_parms *cmd, void *mconfig,
+                                               const char *args)
+{
+    const char *endp = ap_strrchr_c(args, '>');
+    char *provider_name;
+    char *provider_alias;
+    char *provider_args, *extra_args;
+    ap_conf_vector_t *new_authz_config;
+    int old_overrides = cmd->override;
+    const char *errmsg;
+
+    const char *err = ap_check_cmd_context(cmd, GLOBAL_ONLY);
+    if (err != NULL) {
+        return err;
+    }
+
+    if (endp == NULL) {
+        return apr_pstrcat(cmd->pool, cmd->cmd->name,
+                           "> directive missing closing '>'", NULL);
+    }
+
+    args = apr_pstrndup(cmd->temp_pool, args, endp - args);
+
+    if (!args[0]) {
+        return apr_pstrcat(cmd->pool, cmd->cmd->name,
+                           "> directive requires additional arguments", NULL);
+    }
+
+    /* Pull the real provider name and the alias name from the block header */
+    provider_name = ap_getword_conf(cmd->pool, &args);
+    provider_alias = ap_getword_conf(cmd->pool, &args);
+    provider_args = ap_getword_conf(cmd->pool, &args);
+    extra_args = ap_getword_conf(cmd->pool, &args);
+
+    if (!provider_name[0] || !provider_alias[0]) {
+        return apr_pstrcat(cmd->pool, cmd->cmd->name,
+                           "> directive requires additional arguments", NULL);
+    }
+    
+    /* We only handle one "Require-Parameters" parameter.  If several parameters
+       are needed, they must be enclosed between quotes */
+    if (extra_args && *extra_args) {
+        ap_log_error(APLOG_MARK, APLOG_WARNING, 0, cmd->server, APLOGNO(10142)
+                     "When several arguments (%s %s...) are passed to a %s directive, "
+                     "they must be enclosed in quotation marks.  Otherwise, only the "
+                     "first one is taken into account",
+                     provider_args, extra_args, cmd->cmd->name);
+    }
+
+    new_authz_config = ap_create_per_dir_config(cmd->pool);
+
+    /* Walk the subsection configuration to get the per_dir config that we will
+     * merge just before the real provider is called.
+     */
+    cmd->override = OR_AUTHCFG | ACCESS_CONF;
+    errmsg = ap_walk_config(cmd->directive->first_child, cmd,
+                            new_authz_config);
+    cmd->override = old_overrides;
+
+    if (!errmsg) {
+        provider_alias_rec *prvdraliasrec;
+        authz_core_srv_conf *authcfg;
+
+        prvdraliasrec = apr_pcalloc(cmd->pool, sizeof(*prvdraliasrec));
+
+        /* Save off the new directory config along with the original
+         * provider name and function pointer data
+         */
+        prvdraliasrec->provider_name = provider_name;
+        prvdraliasrec->provider_alias = provider_alias;
+        prvdraliasrec->provider_args = provider_args;
+        prvdraliasrec->sec_auth = new_authz_config;
+        prvdraliasrec->provider =
+            ap_lookup_provider(AUTHZ_PROVIDER_GROUP, provider_name,
+                               AUTHZ_PROVIDER_VERSION);
+
+        /* by the time the config file is used, the provider should be loaded
+         * and registered with us.
+         */
+        if (!prvdraliasrec->provider) {
+            return apr_psprintf(cmd->pool,
+                                "Unknown Authz provider: %s",
+                                provider_name);
+        }
+        if (prvdraliasrec->provider->parse_require_line) {
+            err = prvdraliasrec->provider->parse_require_line(cmd,
+                         provider_args, &prvdraliasrec->provider_parsed_args);
+            if (err)
+                return apr_psprintf(cmd->pool,
+                                    "Can't parse 'Require %s %s': %s",
+                                    provider_name, provider_args, err);
+        }
+
+        authcfg = ap_get_module_config(cmd->server->module_config,
+                                       &authz_core_module);
+
+        apr_hash_set(authcfg->alias_rec, provider_alias,
+                     APR_HASH_KEY_STRING, prvdraliasrec);
+
+        /* Register the fake provider so that we get called first */
+        ap_register_auth_provider(cmd->pool, AUTHZ_PROVIDER_GROUP,
+                                  provider_alias, AUTHZ_PROVIDER_VERSION,
+                                  &authz_alias_provider,
+                                  AP_AUTH_INTERNAL_PER_CONF);
+    }
+
+    return errmsg;
+}
+
+static const char* format_authz_result(authz_status result)
+{
+    return ((result == AUTHZ_DENIED)
+            ? "denied"
+            : ((result == AUTHZ_GRANTED)
+               ? "granted"
+               : ((result == AUTHZ_DENIED_NO_USER)
+                  ? "denied (no authenticated user yet)"
+                  : "neutral")));
+}
+
+static const char* format_authz_command(apr_pool_t *p,
+                                        authz_section_conf *section)
+{
+    return (section->provider
+            ? apr_pstrcat(p, "Require ", (section->negate ? "not " : ""),
+                          section->provider_name, " ",
+                          section->provider_args, NULL)
+            : apr_pstrcat(p, section->is_merged ? "AuthMerging " : "<Require",
+                          ((section->op == AUTHZ_LOGIC_AND)
+                           ? (section->negate ? "NotAll" : "All")
+                           : (section->negate ? "None" : "Any")),
+                          section->is_merged ? "" : ">", NULL));
+}
+
+static authz_section_conf* create_default_section(apr_pool_t *p)
+{
+    authz_section_conf *section = apr_pcalloc(p, sizeof(*section));
+
+    section->op = AUTHZ_LOGIC_OR;
+
+    return section;
+}
+
+static const char *add_authz_provider(cmd_parms *cmd, void *config,
+                                      const char *args)
+{
+    authz_core_dir_conf *conf = (authz_core_dir_conf*)config;
+    authz_section_conf *section = apr_pcalloc(cmd->pool, sizeof(*section));
+    authz_section_conf *child;
+
+    section->provider_name = ap_getword_conf(cmd->pool, &args);
+
+    if (!strcasecmp(section->provider_name, "not")) {
+        section->provider_name = ap_getword_conf(cmd->pool, &args);
+        section->negate = 1;
+    }
+
+    section->provider_args = args;
+
+    /* lookup and cache the actual provider now */
+    section->provider = ap_lookup_provider(AUTHZ_PROVIDER_GROUP,
+                                           section->provider_name,
+                                           AUTHZ_PROVIDER_VERSION);
+
+    /* by the time the config file is used, the provider should be loaded
+     * and registered with us.
+     */
+    if (!section->provider) {
+        return apr_psprintf(cmd->pool,
+                            "Unknown Authz provider: %s",
+                            section->provider_name);
+    }
+
+    /* if the provider doesn't provide the appropriate function, reject it */
+    if (!section->provider->check_authorization) {
+        return apr_psprintf(cmd->pool,
+                            "The '%s' Authz provider is not supported by any "
+                            "of the loaded authorization modules",
+                            section->provider_name);
+    }
+
+    section->limited = cmd->limited;
+
+    if (section->provider->parse_require_line) {
+        const char *err;
+        apr_pool_userdata_setn(section->provider_name,
+                               AUTHZ_PROVIDER_NAME_NOTE,
+                               apr_pool_cleanup_null,
+                               cmd->temp_pool);
+        err = section->provider->parse_require_line(cmd, args,
+                                              &section->provider_parsed_args);
+
+        if (err)
+            return err;
+    }
+
+    if (!conf->section) {
+        conf->section = create_default_section(cmd->pool);
+    }
+
+    if (section->negate && conf->section->op == AUTHZ_LOGIC_OR) {
+        return apr_psprintf(cmd->pool, "negative %s directive has no effect "
+                            "in %s directive",
+                            cmd->cmd->name,
+                            format_authz_command(cmd->pool, conf->section));
+    }
+
+    conf->section->limited |= section->limited;
+
+    child = conf->section->first;
+
+    if (child) {
+        while (child->next) {
+            child = child->next;
+        }
+
+        child->next = section;
+    }
+    else {
+        conf->section->first = section;
+    }
+
+    return NULL;
+}
+
+static const char *add_authz_section(cmd_parms *cmd, void *mconfig,
+                                     const char *args)
+{
+    authz_core_dir_conf *conf = mconfig;
+    const char *endp = ap_strrchr_c(args, '>');
+    authz_section_conf *old_section = conf->section;
+    authz_section_conf *section;
+    int old_overrides = cmd->override;
+    apr_int64_t old_limited = cmd->limited;
+    const char *errmsg;
+
+    if (endp == NULL) {
+        return apr_pstrcat(cmd->pool, cmd->cmd->name,
+                           "> directive missing closing '>'", NULL);
+    }
+
+    args = apr_pstrndup(cmd->temp_pool, args, endp - args);
+
+    if (args[0]) {
+        return apr_pstrcat(cmd->pool, cmd->cmd->name,
+                           "> directive doesn't take additional arguments",
+                           NULL);
+    }
+
+    section = apr_pcalloc(cmd->pool, sizeof(*section));
+
+    if (!strcasecmp(cmd->cmd->name, "<RequireAll")) {
+        section->op = AUTHZ_LOGIC_AND;
+    }
+    else if (!strcasecmp(cmd->cmd->name, "<RequireAny")) {
+        section->op = AUTHZ_LOGIC_OR;
+    }
+    else if (!strcasecmp(cmd->cmd->name, "<RequireNotAll")) {
+        section->op = AUTHZ_LOGIC_AND;
+        section->negate = 1;
+    }
+    else {
+        section->op = AUTHZ_LOGIC_OR;
+        section->negate = 1;
+    }
+
+    conf->section = section;
+
+    /* trigger NOT_IN_LIMIT errors as if this were a <Limit> directive */
+    cmd->limited &= ~(AP_METHOD_BIT << (METHODS - 1));
+
+    cmd->override = OR_AUTHCFG;
+    errmsg = ap_walk_config(cmd->directive->first_child, cmd, cmd->context);
+    cmd->override = old_overrides;
+
+    cmd->limited = old_limited;
+
+    conf->section = old_section;
+
+    if (errmsg) {
+        return errmsg;
+    }
+
+    if (section->first) {
+        authz_section_conf *child;
+
+        if (!old_section) {
+            old_section = conf->section = create_default_section(cmd->pool);
+        }
+
+        if (section->negate && old_section->op == AUTHZ_LOGIC_OR) {
+            return apr_psprintf(cmd->pool, "%s directive has "
+                                "no effect in %s directive",
+                                format_authz_command(cmd->pool, section),
+                                format_authz_command(cmd->pool, old_section));
+        }
+
+        old_section->limited |= section->limited;
+
+        if (!section->negate && section->op == old_section->op) {
+            /* be associative */
+            section = section->first;
+        }
+
+        child = old_section->first;
+
+        if (child) {
+            while (child->next) {
+                child = child->next;
+            }
+
+            child->next = section;
+        }
+        else {
+            old_section->first = section;
+        }
+    }
+    else {
+        return apr_pstrcat(cmd->pool,
+                           format_authz_command(cmd->pool, section),
+                           " directive contains no authorization directives",
+                           NULL);
+    }
+
+    return NULL;
+}
+
+static const char *authz_merge_sections(cmd_parms *cmd, void *mconfig,
+                                        const char *arg)
+{
+    authz_core_dir_conf *conf = mconfig;
+
+    if (!strcasecmp(arg, "Off")) {
+        conf->op = AUTHZ_LOGIC_OFF;
+    }
+    else if (!strcasecmp(arg, "And")) {
+        conf->op = AUTHZ_LOGIC_AND;
+    }
+    else if (!strcasecmp(arg, "Or")) {
+        conf->op = AUTHZ_LOGIC_OR;
+    }
+    else {
+        return apr_pstrcat(cmd->pool, cmd->cmd->name, " must be one of: "
+                           "Off | And | Or", NULL);
+    }
+
+    return NULL;
+}
+
+static int authz_core_check_section(apr_pool_t *p, server_rec *s,
+                                    authz_section_conf *section, int is_conf)
+{
+    authz_section_conf *prev = NULL;
+    authz_section_conf *child = section->first;
+    int ret = !OK;
+
+    while (child) {
+        if (child->first) {
+            if (authz_core_check_section(p, s, child, 0) != OK) {
+                return !OK;
+            }
+
+            if (child->negate && child->op != section->op) {
+                authz_section_conf *next = child->next;
+
+                /* avoid one level of recursion when De Morgan permits */
+                child = child->first;
+
+                if (prev) {
+                    prev->next = child;
+                }
+                else {
+                    section->first = child;
+                }
+
+                do {
+                    child->negate = !child->negate;
+                } while (child->next && (child = child->next));
+
+                child->next = next;
+            }
+        }
+
+        prev = child;
+        child = child->next;
+    }
+
+    child = section->first;
+
+    while (child) {
+        if (!child->negate) {
+            ret = OK;
+            break;
+        }
+
+        child = child->next;
+    }
+
+    if (ret != OK) {
+        ap_log_error(APLOG_MARK, APLOG_ERR | APLOG_STARTUP, APR_SUCCESS, s, APLOGNO(01624)
+                     "%s directive contains only negative authorization directives",
+                     is_conf ? "<Directory>, <Location>, or similar"
+                             : format_authz_command(p, section));
+    }
+
+    return ret;
+}
+
+static int authz_core_pre_config(apr_pool_t *p, apr_pool_t *plog,
+                                 apr_pool_t *ptemp)
+{
+    authz_core_first_dir_conf = NULL;
+
+    return OK;
+}
+
+static int authz_core_check_config(apr_pool_t *p, apr_pool_t *plog,
+                                   apr_pool_t *ptemp, server_rec *s)
+{
+    authz_core_dir_conf *conf = authz_core_first_dir_conf;
+
+    while (conf) {
+        if (conf->section) {
+            if (authz_core_check_section(p, s, conf->section, 1) != OK) {
+                return !OK;
+            }
+        }
+
+        conf = conf->next;
+    }
+
+    return OK;
+}
+
+static const command_rec authz_cmds[] =
+{
+    AP_INIT_RAW_ARGS("<AuthzProviderAlias", authz_require_alias_section,
+                     NULL, RSRC_CONF,
+                     "container for grouping an authorization provider's "
+                     "directives under a provider alias"),
+    AP_INIT_RAW_ARGS("Require", add_authz_provider, NULL, OR_AUTHCFG,
+                     "specifies authorization directives "
+                     "which one must pass (or not) for a request to suceeed"),
+    AP_INIT_RAW_ARGS("<RequireAll", add_authz_section, NULL, OR_AUTHCFG,
+                     "container for grouping authorization directives "
+                     "of which none must fail and at least one must pass "
+                     "for a request to succeed"),
+    AP_INIT_RAW_ARGS("<RequireAny", add_authz_section, NULL, OR_AUTHCFG,
+                     "container for grouping authorization directives "
+                     "of which one must pass "
+                     "for a request to succeed"),
+#ifdef AUTHZ_EXTRA_CONFIGS
+    AP_INIT_RAW_ARGS("<RequireNotAll", add_authz_section, NULL, OR_AUTHCFG,
+                     "container for grouping authorization directives "
+                     "of which some must fail or none must pass "
+                     "for a request to succeed"),
+#endif
+    AP_INIT_RAW_ARGS("<RequireNone", add_authz_section, NULL, OR_AUTHCFG,
+                     "container for grouping authorization directives "
+                     "of which none must pass "
+                     "for a request to succeed"),
+    AP_INIT_TAKE1("AuthMerging", authz_merge_sections, NULL, OR_AUTHCFG,
+                  "controls how a <Directory>, <Location>, or similar "
+                  "directive's authorization directives are combined with "
+                  "those of its predecessor"),
+    AP_INIT_FLAG("AuthzSendForbiddenOnFailure", ap_set_flag_slot_char,
+                 (void *)APR_OFFSETOF(authz_core_dir_conf, authz_forbidden_on_fail),
+                 OR_AUTHCFG,
+                 "Controls if an authorization failure should result in a "
+                 "'403 FORBIDDEN' response instead of the HTTP-conforming "
+                 "'401 UNAUTHORIZED'"),
+    {NULL}
+};
+
+static authz_status apply_authz_sections(request_rec *r,
+                                         authz_section_conf *section,
+                                         authz_logic_op parent_op)
+{
+    authz_status auth_result;
+
+    /* check to make sure that the request method requires authorization */
+    if (!(section->limited & (AP_METHOD_BIT << r->method_number))) {
+        auth_result =
+            (parent_op == AUTHZ_LOGIC_AND) ? AUTHZ_GRANTED : AUTHZ_NEUTRAL;
+
+        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, APLOGNO(01625)
+                      "authorization result of %s: %s "
+                      "(directive limited to other methods)",
+                      format_authz_command(r->pool, section),
+                      format_authz_result(auth_result));
+
+        return auth_result;
+    }
+
+    if (section->provider) {
+        apr_table_setn(r->notes, AUTHZ_PROVIDER_NAME_NOTE,
+                       section->provider_name);
+
+        auth_result =
+            section->provider->check_authorization(r, section->provider_args,
+                                                   section->provider_parsed_args);
+
+        apr_table_unset(r->notes, AUTHZ_PROVIDER_NAME_NOTE);
+    }
+    else {
+        authz_section_conf *child = section->first;
+
+        auth_result = AUTHZ_NEUTRAL;
+
+        while (child) {
+            authz_status child_result;
+
+            child_result = apply_authz_sections(r, child, section->op);
+
+            if (child_result == AUTHZ_GENERAL_ERROR) {
+                return AUTHZ_GENERAL_ERROR;
+            }
+
+            if (child_result != AUTHZ_NEUTRAL) {
+                /*
+                 * Handling of AUTHZ_DENIED/AUTHZ_DENIED_NO_USER: Return
+                 * AUTHZ_DENIED_NO_USER if providing a user may change the
+                 * result, AUTHZ_DENIED otherwise.
+                 */
+                if (section->op == AUTHZ_LOGIC_AND) {
+                    if (child_result == AUTHZ_DENIED) {
+                        auth_result = child_result;
+                        break;
+                    }
+                    if ((child_result == AUTHZ_DENIED_NO_USER
+                         && auth_result != AUTHZ_DENIED)
+                        || (auth_result == AUTHZ_NEUTRAL)) {
+                        auth_result = child_result;
+                    }
+                }
+                else {
+                    /* AUTHZ_LOGIC_OR */
+                    if (child_result == AUTHZ_GRANTED) {
+                        auth_result = child_result;
+                        break;
+                    }
+                    if ((child_result == AUTHZ_DENIED_NO_USER
+                         && auth_result == AUTHZ_DENIED)
+                        || (auth_result == AUTHZ_NEUTRAL)) {
+                        auth_result = child_result;
+                    }
+                }
+            }
+
+            child = child->next;
+        }
+    }
+
+    if (section->negate) {
+        if (auth_result == AUTHZ_GRANTED) {
+            auth_result = AUTHZ_DENIED;
+        }
+        else if (auth_result == AUTHZ_DENIED ||
+                 auth_result == AUTHZ_DENIED_NO_USER) {
+            /* For negated directives, if the original result was denied
+             * then the new result is neutral since we can not grant
+             * access simply because authorization was not rejected.
+             */
+            auth_result = AUTHZ_NEUTRAL;
+        }
+    }
+
+    ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, APLOGNO(01626)
+                  "authorization result of %s: %s",
+                  format_authz_command(r->pool, section),
+                  format_authz_result(auth_result));
+
+    return auth_result;
+}
+
+static int authorize_user_core(request_rec *r, int after_authn)
+{
+    authz_core_dir_conf *conf;
+    authz_status auth_result;
+
+    conf = ap_get_module_config(r->per_dir_config, &authz_core_module);
+
+    if (!conf->section) {
+        if (ap_auth_type(r)) {
+            /* there's an AuthType configured, but no authorization
+             * directives applied to support it
+             */
+
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01627)
+                          "AuthType configured with no corresponding "
+                          "authorization directives");
+
+            return HTTP_INTERNAL_SERVER_ERROR;
+        }
+
+        ap_log_rerror(APLOG_MARK, APLOG_DEBUG, APR_SUCCESS, r, APLOGNO(01628)
+                      "authorization result: granted (no directives)");
+
+        return OK;
+    }
+
+    auth_result = apply_authz_sections(r, conf->section, AUTHZ_LOGIC_AND);
+
+    if (auth_result == AUTHZ_GRANTED) {
+        return OK;
+    }
+    else if (auth_result == AUTHZ_DENIED_NO_USER) {
+        if (after_authn) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01629)
+                          "authorization failure (no authenticated user): %s",
+                          r->uri);
+            /*
+             * If we're returning 401 to an authenticated user, tell them to
+             * try again. If unauthenticated, note_auth_failure has already
+             * been called during auth.
+             */
+            if (r->user)
+                ap_note_auth_failure(r);
+
+            return HTTP_UNAUTHORIZED;
+        }
+        else {
+            /*
+             * We need a user before we can decide what to do.
+             * Get out of the way and proceed with authentication.
+             */
+            return DECLINED;
+        }
+    }
+    else if (auth_result == AUTHZ_DENIED || auth_result == AUTHZ_NEUTRAL) {
+        if (!after_authn || ap_auth_type(r) == NULL) {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01630)
+                          "client denied by server configuration: %s%s",
+                          r->filename ? "" : "uri ",
+                          r->filename ? r->filename : r->uri);
+
+            return HTTP_FORBIDDEN;
+        }
+        else {
+            ap_log_rerror(APLOG_MARK, APLOG_ERR, APR_SUCCESS, r, APLOGNO(01631)
+                          "user %s: authorization failure for \"%s\": ",
+                          r->user, r->uri);
+
+            if (conf->authz_forbidden_on_fail > 0) {
+                return HTTP_FORBIDDEN;
+            }
+            else {
+                /*
+                 * If we're returning 401 to an authenticated user, tell them to
+                 * try again. If unauthenticated, note_auth_failure has already
+                 * been called during auth.
+                 */
+                if (r->user)
+                    ap_note_auth_failure(r);
+                return HTTP_UNAUTHORIZED;
+            }
+        }
+    }
+    else {
+        /* We'll assume that the module has already said what its
+         * error was in the logs.
+         */
+        return HTTP_INTERNAL_SERVER_ERROR;
+    }
+}
+
+static int authorize_userless(request_rec *r)
+{
+    return authorize_user_core(r, 0);
+}
+
+static int authorize_user(request_rec *r)
+{
+    return authorize_user_core(r, 1);
+}
+
+static int authz_some_auth_required(request_rec *r)
+{
+    authz_core_dir_conf *conf;
+
+    conf = ap_get_module_config(r->per_dir_config, &authz_core_module);
+
+    if (conf->section
+        && (conf->section->limited & (AP_METHOD_BIT << r->method_number))) {
+        return 1;
+    }
+
+    return 0;
+}
+
+/*
+ * env authz provider
+ */
+
+static authz_status env_check_authorization(request_rec *r,
+                                            const char *require_line,
+                                            const void *parsed_require_line)
+{
+    const char *t, *w;
+
+    /* The 'env' provider will allow the configuration to specify a list of
+        env variables to check rather than a single variable.  This is different
+        from the previous host based syntax. */
+    t = require_line;
+    while ((w = ap_getword_conf(r->pool, &t)) && w[0]) {
+        if (apr_table_get(r->subprocess_env, w)) {
+            return AUTHZ_GRANTED;
+        }
+    }
+
+    return AUTHZ_DENIED;
+}
+
+static const authz_provider authz_env_provider =
+{
+    &env_check_authorization,
+    NULL,
+};
+
+
+/*
+ * all authz provider
+ */
+
+static authz_status all_check_authorization(request_rec *r,
+                                            const char *require_line,
+                                            const void *parsed_require_line)
+{
+    if (parsed_require_line) {
+        return AUTHZ_GRANTED;
+    }
+    return AUTHZ_DENIED;
+}
+
+static const char *all_parse_config(cmd_parms *cmd, const char *require_line,
+                                    const void **parsed_require_line)
+{
+    /*
+     * If the argument to the 'all' provider is 'granted' then just let
+     * everybody in. This would be equivalent to the previous syntax of
+     * 'allow from all'. If the argument is 'denied' we reject everybody,
+     * which is equivalent to 'deny from all'.
+     */
+    if (strcasecmp(require_line, "granted") == 0) {
+        *parsed_require_line = (void *)1;
+        return NULL;
+    }
+    else if (strcasecmp(require_line, "denied") == 0) {
+        /* *parsed_require_line is already NULL */
+        return NULL;
+    }
+    else {
+        return "Argument for 'Require all' must be 'granted' or 'denied'";
+    }
+}
+
+static const authz_provider authz_all_provider =
+{
+    &all_check_authorization,
+    &all_parse_config,
+};
+
+
+/*
+ * method authz provider
+ */
+
+static authz_status method_check_authorization(request_rec *r,
+                                               const char *require_line,
+                                               const void *parsed_require_line)
+{
+    const apr_int64_t *allowed = parsed_require_line;
+    if (*allowed & (AP_METHOD_BIT << r->method_number))
+        return AUTHZ_GRANTED;
+    else
+        return AUTHZ_DENIED;
+}
+
+static const char *method_parse_config(cmd_parms *cmd, const char *require_line,
+                                       const void **parsed_require_line)
+{
+    const char *w, *t;
+    apr_int64_t *allowed = apr_pcalloc(cmd->pool, sizeof(apr_int64_t));
+
+    t = require_line;
+
+    while ((w = ap_getword_conf(cmd->temp_pool, &t)) && w[0]) {
+        int m = ap_method_number_of(w);
+        if (m == M_INVALID) {
+            return apr_pstrcat(cmd->pool, "Invalid Method '", w, "'", NULL);
+        }
+
+        *allowed |= (AP_METHOD_BIT << m);
+    }
+
+    *parsed_require_line = allowed;
+    return NULL;
+}
+
+static const authz_provider authz_method_provider =
+{
+    &method_check_authorization,
+    &method_parse_config,
+};
+
+/*
+ * expr authz provider
+ */
+
+#define REQUIRE_EXPR_NOTE "Require_expr_info"
+struct require_expr_info {
+    ap_expr_info_t *expr;
+    int want_user;
+};
+
+static int expr_lookup_fn(ap_expr_lookup_parms *parms)
+{
+    if (parms->type == AP_EXPR_FUNC_VAR
+        && strcasecmp(parms->name, "REMOTE_USER") == 0) {
+        struct require_expr_info *info;
+        apr_pool_userdata_get((void**)&info, REQUIRE_EXPR_NOTE, parms->ptemp);
+        AP_DEBUG_ASSERT(info != NULL);
+        info->want_user = 1;
+    }
+    return ap_expr_lookup_default(parms);
+}
+
+static const char *expr_parse_config(cmd_parms *cmd, const char *require_line,
+                                     const void **parsed_require_line)
+{
+    const char *expr_err = NULL;
+    struct require_expr_info *info = apr_pcalloc(cmd->pool, sizeof(*info));
+
+    /* if the expression happens to be surrounded by quotes, skip them */
+    if (require_line[0] == '"') {
+        apr_size_t len = strlen(require_line);
+
+        if (require_line[len-1] == '"')
+            require_line = apr_pstrndup(cmd->temp_pool,
+                                        require_line + 1,
+                                        len - 2);
+    }
+
+    apr_pool_userdata_setn(info, REQUIRE_EXPR_NOTE, apr_pool_cleanup_null,
+                          cmd->temp_pool);
+    info->expr = ap_expr_parse_cmd(cmd, require_line, 0, &expr_err,
+                                   expr_lookup_fn);
+
+    if (expr_err)
+        return apr_pstrcat(cmd->temp_pool,
+                           "Cannot parse expression in require line: ",
+                           expr_err, NULL);
+
+    *parsed_require_line = info;
+
+    return NULL;
+}
+
+static authz_status expr_check_authorization(request_rec *r,
+                                             const char *require_line,
+                                             const void *parsed_require_line)
+{
+    const char *err = NULL;
+    const struct require_expr_info *info = parsed_require_line;
+    int rc = ap_expr_exec(r, info->expr, &err);
+
+    if (rc < 0) {
+        ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(02320)
+                      "Error evaluating expression in 'Require expr': %s",
+                      err);
+        return AUTHZ_GENERAL_ERROR;
+    }
+    else if (rc == 0) {
+        if (info->want_user)
+            return AUTHZ_DENIED_NO_USER;
+        else
+            return AUTHZ_DENIED;
+    }
+    else {
+        return AUTHZ_GRANTED;
+    }
+}
+
+static const authz_provider authz_expr_provider =
+{
+    &expr_check_authorization,
+    &expr_parse_config,
+};
+
+
+static void register_hooks(apr_pool_t *p)
+{
+    APR_REGISTER_OPTIONAL_FN(authz_some_auth_required);
+
+    ap_hook_pre_config(authz_core_pre_config, NULL, NULL, APR_HOOK_MIDDLE);
+    ap_hook_check_config(authz_core_check_config, NULL, NULL, APR_HOOK_MIDDLE);
+    ap_hook_check_authz(authorize_user, NULL, NULL, APR_HOOK_LAST,
+                        AP_AUTH_INTERNAL_PER_CONF);
+    ap_hook_check_access_ex(authorize_userless, NULL, NULL, APR_HOOK_LAST,
+                            AP_AUTH_INTERNAL_PER_CONF);
+
+    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "env",
+                              AUTHZ_PROVIDER_VERSION,
+                              &authz_env_provider, AP_AUTH_INTERNAL_PER_CONF);
+    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "all",
+                              AUTHZ_PROVIDER_VERSION,
+                              &authz_all_provider, AP_AUTH_INTERNAL_PER_CONF);
+    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "method",
+                              AUTHZ_PROVIDER_VERSION,
+                              &authz_method_provider, AP_AUTH_INTERNAL_PER_CONF);
+    ap_register_auth_provider(p, AUTHZ_PROVIDER_GROUP, "expr",
+                              AUTHZ_PROVIDER_VERSION,
+                              &authz_expr_provider, AP_AUTH_INTERNAL_PER_CONF);
+}
+
+AP_DECLARE_MODULE(authz_core) =
+{
+    STANDARD20_MODULE_STUFF,
+    create_authz_core_dir_config,   /* dir config creater */
+    merge_authz_core_dir_config,    /* dir merger */
+    create_authz_core_svr_config,   /* server config */
+    merge_authz_core_svr_config ,   /* merge server config */
+    authz_cmds,
+    register_hooks                  /* register hooks */
+};
+