From: Chris Pepper Date: Sun, 26 Nov 2006 06:36:35 +0000 (+0000) Subject: Reword Order section to make 3-pass design clearer. X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f01716f4abd071fe2e95144fdc03ad1ccb18dcb1;p=thirdparty%2Fapache%2Fhttpd.git Reword Order section to make 3-pass design clearer. Add table showing results of match combinations. Fix some tenses. Fix case of CENTER & IP Address. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@479297 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/htdocs/manual/mod/mod_access.html.en b/htdocs/manual/mod/mod_access.html.en index 6b47ed347fa..f24e766bf19 100644 --- a/htdocs/manual/mod/mod_access.html.en +++ b/htdocs/manual/mod/mod_access.html.en @@ -13,7 +13,7 @@ vlink="#000080" alink="#FF0000"> -

Module mod_access

+

Module mod_access

This module provides access control based on client hostname, IP address, or other characteristics of the client @@ -91,7 +91,7 @@

The Allow directive affects which hosts can access an area of the server. Access can be controlled by - hostname, IP Address, IP Address range, or by other + hostname, IP address, IP address range, or other characteristics of the client request captured in environment variables.

@@ -233,42 +233,76 @@ SetEnvIf User-Agent ^KnockKnock/2\.0 let_me_in Module: mod_access

-

The Order directive controls the default access - state and the order in which Allow and Deny directives are evaluated. - Ordering is one of

+

The Order directive, along with the + Allow and Deny directives, controls a + three-pass access control system. The first pass processes either + all Allow or all Deny directives, as + specified by the Order directive. The second pass + parses the rest of the directives (Deny or + Allow). The third pass applies to all requests which do + not match either of the first two.

+ +

Note that all Allow and Deny directives + are processed, unlike a typical firewall, where only the first match + is used. The last match is effective (also unlike a typical + firewall). Additionally, the order in which lines appear in the + configuration files is not significant -- all Allow + lines are processed as one group, all Deny lines are + considered as another, and the default state is considered by + itself.

+ +

Ordering is one of:

-
Deny,Allow
- -
The Deny directives are evaluated before the - Allow directives. Access is allowed by default. - Any client which does not match a Deny directive - or does match an Allow directive will be allowed - access to the server.
- -
Allow,Deny
- -
The Allow directives are evaluated before - the Deny directives. Access is denied by - default. Any client which does not match an - Allow directive or does match a - Deny directive will be denied access to the - server.
- -
Mutual-failure
- -
Only those hosts which appear on the Allow - list and do not appear on the Deny list are - granted access. This ordering has the same effect as - Order Allow,Deny and is deprecated in favor of - that configuration.
+
Deny,Allow
+ +
First, all Allow directives are evaluated; at + least one must match, or the request is rejected. Next, all + Deny directives are evaluated. If any matches, the + request is rejected. Last, any requests which do not match an + Allow or a Deny directive are denied by + default.
+ +
Allow,Deny
+ +
First, all Deny directives are evaluated; if any + match, the request is denied unless it also + matches an Allow directive. Any requests which do not + match any Allow or Deny directives are + permitted.
+ +
Mutual-failure
+ +
This order has the same effect as Order + Allow,Deny and is deprecated in its favor.

Keywords may only be separated by a comma; no whitespace is - allowed between them. Note that in all cases every - Allow and Deny statement is - evaluated.

+ allowed between them.

+ + + + + + + + + + + + + + + + + + + + + + + +
Allow,Deny matchAllow,Deny resultDeny,Allow result
Match Allow onlyRequest allowedRequest allowed
Match Deny onlyRequest deniedRequest denied
No matchDefault to second directive (Denied)Default to second directive (Allowed)
Match both Allow & DenyFinal match controls: request DeniedFinal match controls: request Allowed

In the following example, all hosts in the apache.org domain are allowed access; all other hosts are denied access.

@@ -300,8 +334,8 @@ SetEnvIf User-Agent ^KnockKnock/2\.0 let_me_in the Allow from apache.org will be evaluated last and will override the Deny from foo.apache.org. All hosts not in the apache.org domain will also - be allowed access because the default state will change to - allow.

+ be allowed access because the default state will be + Allow.

The presence of an Order directive can affect access to a part of the server even in the absence of @@ -316,8 +350,8 @@ SetEnvIf User-Agent ^KnockKnock/2\.0 let_me_in

will deny all access to the /www directory - because the default access state will be set to - deny.

+ because the default access state is set to + Deny.

The Order directive controls the order of access directive processing only within each phase of the