summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--meta/recipes-devtools/subversion/subversion-1.8.13/subversion-CVE-2015-3184.patch2094
-rw-r--r--meta/recipes-devtools/subversion/subversion_1.8.13.bb1
2 files changed, 2095 insertions, 0 deletions
diff --git a/meta/recipes-devtools/subversion/subversion-1.8.13/subversion-CVE-2015-3184.patch b/meta/recipes-devtools/subversion/subversion-1.8.13/subversion-CVE-2015-3184.patch
new file mode 100644
index 0000000000..0663bd2719
--- /dev/null
+++ b/meta/recipes-devtools/subversion/subversion-1.8.13/subversion-CVE-2015-3184.patch
@@ -0,0 +1,2094 @@
1Fix CVE-2015-3184
2
3Patch is from:
4http://subversion.apache.org/security/CVE-2015-3184-advisory.txt
5
6Upstream-Status: Backport
7
8Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
9
10Index: Makefile.in
11===================================================================
12--- a/Makefile.in (revision 1691883)
13+++ b/Makefile.in (working copy)
14@@ -357,6 +357,7 @@ TEST_SHLIB_VAR_SWIG_RB=\
15 fi;
16
17 APXS = @APXS@
18+HTTPD_VERSION = @HTTPD_VERSION@
19
20 PYTHON = @PYTHON@
21 PERL = @PERL@
22@@ -509,6 +510,9 @@ check: bin @TRANSFORM_LIBTOOL_SCRIPTS@ $(TEST_DEPS
23 if test "$(HTTP_LIBRARY)" != ""; then \
24 flags="--http-library $(HTTP_LIBRARY) $$flags"; \
25 fi; \
26+ if test "$(HTTPD_VERSION)" != ""; then \
27+ flags="--httpd-version $(HTTPD_VERSION) $$flags"; \
28+ fi; \
29 if test "$(SERVER_MINOR_VERSION)" != ""; then \
30 flags="--server-minor-version $(SERVER_MINOR_VERSION) $$flags"; \
31 fi; \
32Index: build/ac-macros/apache.m4
33===================================================================
34--- a/build/ac-macros/apache.m4 (revision 1691883)
35+++ b/build/ac-macros/apache.m4 (working copy)
36@@ -160,6 +160,20 @@ if test -n "$APXS" && test "$APXS" != "no"; then
37 BUILD_APACHE_RULE=apache-mod
38 INSTALL_APACHE_RULE=install-mods-shared
39 INSTALL_APACHE_MODS=true
40+ HTTPD="`$APXS -q sbindir`/`$APXS -q PROGNAME`"
41+ if ! test -e $HTTPD ; then
42+ HTTPD="`$APXS -q bindir`/`$APXS -q PROGNAME`"
43+ fi
44+ HTTPD_VERSION=["`$HTTPD -v | $SED -e 's@^.*/\([0-9.]*\)\(.*$\)@\1@ ; 1q'`"]
45+ AC_ARG_ENABLE(broken-httpd-auth,
46+ AS_HELP_STRING([--enable-broken-httpd-auth],
47+ [Allow building against httpd 2.4 with broken auth]),
48+ [broken_httpd_auth=$enableval],[broken_httpd_auth=no])
49+ if test "$enable_broken_httpd_auth" = "yes"; then
50+ AC_MSG_NOTICE([Building with broken httpd auth])
51+ AC_DEFINE(SVN_ALLOW_BROKEN_HTTPD_AUTH, 1,
52+ [Defined to allow building against httpd 2.4 with broken auth])
53+ fi
54
55 case $host in
56 *-*-cygwin*)
57@@ -178,6 +192,7 @@ AC_SUBST(APACHE_LDFLAGS)
58 AC_SUBST(APACHE_INCLUDES)
59 AC_SUBST(APACHE_LIBEXECDIR)
60 AC_SUBST(INSTALL_APACHE_MODS)
61+AC_SUBST(HTTPD_VERSION)
62
63 # there aren't any flags that interest us ...
64 #if test -n "$APXS" && test "$APXS" != "no"; then
65Index: build/run_tests.py
66===================================================================
67--- a/build/run_tests.py (revision 1691883)
68+++ b/build/run_tests.py (working copy)
69@@ -29,6 +29,7 @@
70 [--fs-type=<fs-type>] [--fsfs-packing] [--fsfs-sharding=<n>]
71 [--list] [--milestone-filter=<regex>] [--mode-filter=<type>]
72 [--server-minor-version=<version>] [--http-proxy=<host>:<port>]
73+ [--httpd-version=<version>]
74 [--config-file=<file>] [--ssl-cert=<file>]
75 <abs_srcdir> <abs_builddir>
76 <prog ...>
77@@ -125,7 +126,7 @@ class TestHarness:
78 fsfs_sharding=None, fsfs_packing=None,
79 list_tests=None, svn_bin=None, mode_filter=None,
80 milestone_filter=None, set_log_level=None, ssl_cert=None,
81- http_proxy=None):
82+ http_proxy=None, httpd_version=None):
83 '''Construct a TestHarness instance.
84
85 ABS_SRCDIR and ABS_BUILDDIR are the source and build directories.
86@@ -178,6 +179,7 @@ class TestHarness:
87 self.log = None
88 self.ssl_cert = ssl_cert
89 self.http_proxy = http_proxy
90+ self.httpd_version = httpd_version
91 if not sys.stdout.isatty() or sys.platform == 'win32':
92 TextColors.disable()
93
94@@ -481,6 +483,8 @@ class TestHarness:
95 svntest.main.options.ssl_cert = self.ssl_cert
96 if self.http_proxy is not None:
97 svntest.main.options.http_proxy = self.http_proxy
98+ if self.httpd_version is not None:
99+ svntest.main.options.httpd_version = self.httpd_version
100
101 svntest.main.options.srcdir = self.srcdir
102
103@@ -645,7 +649,7 @@ def main():
104 'enable-sasl', 'parallel', 'config-file=',
105 'log-to-stdout', 'list', 'milestone-filter=',
106 'mode-filter=', 'set-log-level=', 'ssl-cert=',
107- 'http-proxy='])
108+ 'http-proxy=', 'httpd-version='])
109 except getopt.GetoptError:
110 args = []
111
112@@ -656,9 +660,9 @@ def main():
113 base_url, fs_type, verbose, cleanup, enable_sasl, http_library, \
114 server_minor_version, fsfs_sharding, fsfs_packing, parallel, \
115 config_file, log_to_stdout, list_tests, mode_filter, milestone_filter, \
116- set_log_level, ssl_cert, http_proxy = \
117+ set_log_level, ssl_cert, http_proxy, httpd_version = \
118 None, None, None, None, None, None, None, None, None, None, None, \
119- None, None, None, None, None, None, None
120+ None, None, None, None, None, None, None, None
121 for opt, val in opts:
122 if opt in ['-u', '--url']:
123 base_url = val
124@@ -696,6 +700,8 @@ def main():
125 ssl_cert = val
126 elif opt in ['--http-proxy']:
127 http_proxy = val
128+ elif opt in ['--httpd-version']:
129+ httpd_version = val
130 else:
131 raise getopt.GetoptError
132
133@@ -712,7 +718,7 @@ def main():
134 fsfs_sharding, fsfs_packing, list_tests,
135 mode_filter=mode_filter, milestone_filter=milestone_filter,
136 set_log_level=set_log_level, ssl_cert=ssl_cert,
137- http_proxy=http_proxy)
138+ http_proxy=http_proxy, httpd_version=httpd_version)
139
140 failed = th.run(args[2:])
141 if failed:
142Index: subversion/mod_authz_svn/mod_authz_svn.c
143===================================================================
144--- a/subversion/mod_authz_svn/mod_authz_svn.c (revision 1691883)
145+++ b/subversion/mod_authz_svn/mod_authz_svn.c (working copy)
146@@ -48,6 +48,23 @@
147 #include "svn_dirent_uri.h"
148 #include "private/svn_fspath.h"
149
150+/* The apache headers define these and they conflict with our definitions. */
151+#ifdef PACKAGE_BUGREPORT
152+#undef PACKAGE_BUGREPORT
153+#endif
154+#ifdef PACKAGE_NAME
155+#undef PACKAGE_NAME
156+#endif
157+#ifdef PACKAGE_STRING
158+#undef PACKAGE_STRING
159+#endif
160+#ifdef PACKAGE_TARNAME
161+#undef PACKAGE_TARNAME
162+#endif
163+#ifdef PACKAGE_VERSION
164+#undef PACKAGE_VERSION
165+#endif
166+#include "svn_private_config.h"
167
168 #ifdef APLOG_USE_MODULE
169 APLOG_USE_MODULE(authz_svn);
170@@ -67,6 +84,30 @@ typedef struct authz_svn_config_rec {
171 const char *force_username_case;
172 } authz_svn_config_rec;
173
174+#if AP_MODULE_MAGIC_AT_LEAST(20060110,0) /* version where
175+ ap_some_auth_required breaks */
176+# if AP_MODULE_MAGIC_AT_LEAST(20120211,47) /* first version with
177+ force_authn hook and
178+ ap_some_authn_required() which
179+ allows us to work without
180+ ap_some_auth_required() */
181+# define USE_FORCE_AUTHN 1
182+# define IN_SOME_AUTHN_NOTE "authz_svn-in-some-authn"
183+# define FORCE_AUTHN_NOTE "authz_svn-force-authn"
184+# else
185+ /* ap_some_auth_required() is busted and no viable alternative exists */
186+# ifndef SVN_ALLOW_BROKEN_HTTPD_AUTH
187+# error This version of httpd has a security hole with mod_authz_svn
188+# else
189+ /* user wants to build anyway */
190+# define USE_FORCE_AUTHN 0
191+# endif
192+# endif
193+#else
194+ /* old enough that ap_some_auth_required() still works */
195+# define USE_FORCE_AUTHN 0
196+#endif
197+
198 /*
199 * Configuration
200 */
201@@ -819,9 +860,51 @@ access_checker(request_rec *r)
202 &authz_svn_module);
203 const char *repos_path = NULL;
204 const char *dest_repos_path = NULL;
205- int status;
206+ int status, authn_required;
207
208+#if USE_FORCE_AUTHN
209+ /* Use the force_authn() hook available in 2.4.x to work securely
210+ * given that ap_some_auth_required() is no longer functional for our
211+ * purposes in 2.4.x.
212+ */
213+ int authn_configured;
214+
215 /* We are not configured to run */
216+ if (!conf->anonymous || apr_table_get(r->notes, IN_SOME_AUTHN_NOTE)
217+ || (! (conf->access_file || conf->repo_relative_access_file)))
218+ return DECLINED;
219+
220+ /* Authentication is configured */
221+ authn_configured = ap_auth_type(r) != NULL;
222+ if (authn_configured)
223+ {
224+ /* If the user is trying to authenticate, let him. It doesn't
225+ * make much sense to grant anonymous access but deny authenticated
226+ * users access, even though you can do that with '$anon' in the
227+ * access file.
228+ */
229+ if (apr_table_get(r->headers_in,
230+ (PROXYREQ_PROXY == r->proxyreq)
231+ ? "Proxy-Authorization" : "Authorization"))
232+ {
233+ /* Set the note to force authn regardless of what access_checker_ex
234+ hook requires */
235+ apr_table_setn(r->notes, FORCE_AUTHN_NOTE, (const char*)1);
236+
237+ /* provide the proper return so the access_checker hook doesn't
238+ * prevent the code from continuing on to the other auth hooks */
239+ if (ap_satisfies(r) != SATISFY_ANY)
240+ return OK;
241+ else
242+ return HTTP_FORBIDDEN;
243+ }
244+ }
245+
246+#else
247+ /* Support for older versions of httpd that have a working
248+ * ap_some_auth_required() */
249+
250+ /* We are not configured to run */
251 if (!conf->anonymous
252 || (! (conf->access_file || conf->repo_relative_access_file)))
253 return DECLINED;
254@@ -834,9 +917,10 @@ access_checker(request_rec *r)
255 if (ap_satisfies(r) != SATISFY_ANY)
256 return DECLINED;
257
258- /* If the user is trying to authenticate, let him. If anonymous
259- * access is allowed, so is authenticated access, by definition
260- * of the meaning of '*' in the access file.
261+ /* If the user is trying to authenticate, let him. It doesn't
262+ * make much sense to grant anonymous access but deny authenticated
263+ * users access, even though you can do that with '$anon' in the
264+ * access file.
265 */
266 if (apr_table_get(r->headers_in,
267 (PROXYREQ_PROXY == r->proxyreq)
268@@ -848,6 +932,7 @@ access_checker(request_rec *r)
269 return HTTP_FORBIDDEN;
270 }
271 }
272+#endif
273
274 /* If anon access is allowed, return OK */
275 status = req_check_access(r, conf, &repos_path, &dest_repos_path);
276@@ -856,7 +941,26 @@ access_checker(request_rec *r)
277 if (!conf->authoritative)
278 return DECLINED;
279
280+#if USE_FORCE_AUTHN
281+ if (authn_configured) {
282+ /* We have to check to see if authn is required because if so we must
283+ * return UNAUTHORIZED (401) rather than FORBIDDEN (403) since returning
284+ * the 403 leaks information about what paths may exist to
285+ * unauthenticated users. We must set a note here in order
286+ * to use ap_some_authn_rquired() without triggering an infinite
287+ * loop since the call will trigger this function to be called again. */
288+ apr_table_setn(r->notes, IN_SOME_AUTHN_NOTE, (const char*)1);
289+ authn_required = ap_some_authn_required(r);
290+ apr_table_unset(r->notes, IN_SOME_AUTHN_NOTE);
291+ if (authn_required)
292+ {
293+ ap_note_auth_failure(r);
294+ return HTTP_UNAUTHORIZED;
295+ }
296+ }
297+#else
298 if (!ap_some_auth_required(r))
299+#endif
300 log_access_verdict(APLOG_MARK, r, 0, repos_path, dest_repos_path);
301
302 return HTTP_FORBIDDEN;
303@@ -937,6 +1041,17 @@ auth_checker(request_rec *r)
304 return OK;
305 }
306
307+#if USE_FORCE_AUTHN
308+static int
309+force_authn(request_rec *r)
310+{
311+ if (apr_table_get(r->notes, FORCE_AUTHN_NOTE))
312+ return OK;
313+
314+ return DECLINED;
315+}
316+#endif
317+
318 /*
319 * Module flesh
320 */
321@@ -953,6 +1068,9 @@ register_hooks(apr_pool_t *p)
322 * give SSLOptions +FakeBasicAuth a chance to work. */
323 ap_hook_check_user_id(check_user_id, mod_ssl, NULL, APR_HOOK_FIRST);
324 ap_hook_auth_checker(auth_checker, NULL, NULL, APR_HOOK_FIRST);
325+#if USE_FORCE_AUTHN
326+ ap_hook_force_authn(force_authn, NULL, NULL, APR_HOOK_FIRST);
327+#endif
328 ap_register_provider(p,
329 AUTHZ_SVN__SUBREQ_BYPASS_PROV_GRP,
330 AUTHZ_SVN__SUBREQ_BYPASS_PROV_NAME,
331Index: subversion/tests/cmdline/README
332===================================================================
333--- a/subversion/tests/cmdline/README (revision 1691883)
334+++ b/subversion/tests/cmdline/README (working copy)
335@@ -83,6 +83,133 @@ paths adjusted appropriately:
336 Require valid-user
337 </Location>
338
339+ <Location /authz-test-work/anon>
340+ DAV svn
341+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
342+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
343+ SVNListParentPath On
344+ # This may seem unnecessary but granting access to everyone here is necessary
345+ # to exercise a bug with httpd 2.3.x+. The "Require all granted" syntax is
346+ # new to 2.3.x+ which we can detect with the mod_authz_core.c module
347+ # signature. Use the "Allow from all" syntax with older versions for symmetry.
348+ <IfModule mod_authz_core.c>
349+ Require all granted
350+ </IfModule>
351+ <IfModule !mod_authz_core.c>
352+ Allow from all
353+ </IfMOdule>
354+ </Location>
355+ <Location /authz-test-work/mixed>
356+ DAV svn
357+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
358+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
359+ SVNListParentPath On
360+ AuthType Basic
361+ AuthName "Subversion Repository"
362+ AuthUserFile /usr/local/apache2/conf/users
363+ Require valid-user
364+ Satisfy Any
365+ </Location>
366+ <Location /authz-test-work/mixed-noauthwhenanon>
367+ DAV svn
368+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
369+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
370+ SVNListParentPath On
371+ AuthType Basic
372+ AuthName "Subversion Repository"
373+ AuthUserFile /usr/local/apache2/conf/users
374+ Require valid-user
375+ AuthzSVNNoAuthWhenAnonymousAllowed On
376+ </Location>
377+ <Location /authz-test-work/authn>
378+ DAV svn
379+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
380+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
381+ SVNListParentPath On
382+ AuthType Basic
383+ AuthName "Subversion Repository"
384+ AuthUserFile /usr/local/apache2/conf/users
385+ Require valid-user
386+ </Location>
387+ <Location /authz-test-work/authn-anonoff>
388+ DAV svn
389+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
390+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
391+ SVNListParentPath On
392+ AuthType Basic
393+ AuthName "Subversion Repository"
394+ AuthUserFile /usr/local/apache2/conf/users
395+ Require valid-user
396+ AuthzSVNAnonymous Off
397+ </Location>
398+ <Location /authz-test-work/authn-lcuser>
399+ DAV svn
400+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
401+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
402+ SVNListParentPath On
403+ AuthType Basic
404+ AuthName "Subversion Repository"
405+ AuthUserFile /usr/local/apache2/conf/users
406+ Require valid-user
407+ AuthzForceUsernameCase Lower
408+ </Location>
409+ <Location /authz-test-work/authn-lcuser>
410+ DAV svn
411+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
412+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
413+ SVNListParentPath On
414+ AuthType Basic
415+ AuthName "Subversion Repository"
416+ AuthUserFile /usr/local/apache2/conf/users
417+ Require valid-user
418+ AuthzForceUsernameCase Lower
419+ </Location>
420+ <Location /authz-test-work/authn-group>
421+ DAV svn
422+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
423+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
424+ SVNListParentPath On
425+ AuthType Basic
426+ AuthName "Subversion Repository"
427+ AuthUserFile /usr/local/apache2/conf/users
428+ AuthGroupFile /usr/local/apache2/conf/groups
429+ Require group random
430+ AuthzSVNAuthoritative Off
431+ </Location>
432+ <IfModule mod_authz_core.c>
433+ <Location /authz-test-work/sallrany>
434+ DAV svn
435+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
436+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
437+ SVNListParentPath On
438+ AuthType Basic
439+ AuthName "Subversion Repository"
440+ AuthUserFile /usr/local/apache2/conf/users
441+ AuthzSendForbiddenOnFailure On
442+ Satisfy All
443+ <RequireAny>
444+ Require valid-user
445+ Require expr req('ALLOW') == '1'
446+ </RequireAny>
447+ </Location>
448+ <Location /authz-test-work/sallrall>
449+ DAV svn
450+ SVNParentPath /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/local_tmp
451+ AuthzSVNAccessFile /home/yourusernamehere/projects/svn/subversion/tests/cmdline/svn-test-work/authz
452+ SVNListParentPath On
453+ AuthType Basic
454+ AuthName "Subversion Repository"
455+ AuthUserFile /usr/local/apache2/conf/users
456+ AuthzSendForbiddenOnFailure On
457+ Satisfy All
458+ <RequireAll>
459+ Require valid-user
460+ Require expr req('ALLOW') == '1'
461+ </RequireAll>
462+ </Location>
463+ </IfModule>
464+
465+
466 RedirectMatch permanent ^/svn-test-work/repositories/REDIRECT-PERM-(.*)$ /svn-test-work/repositories/$1
467 RedirectMatch ^/svn-test-work/repositories/REDIRECT-TEMP-(.*)$ /svn-test-work/repositories/$1
468
469@@ -101,8 +228,17 @@ just drop the following 2-line snippet into the
470 ----------------------------
471 jrandom:xCGl35kV9oWCY
472 jconstant:xCGl35kV9oWCY
473+JRANDOM:xCGl35kV9oWCY
474+JCONSTANT:xCGl35kV9oWCY
475 ----------------------------
476
477+and these lines into the
478+/usr/local/apache/conf/groups file:
479+----------------------------
480+random: jrandom
481+constant: jconstant
482+----------------------------
483+
484 Now, (re)start Apache and run the tests over mod_dav_svn.
485
486 You can run a test script over DAV:
487@@ -138,6 +274,8 @@ Note [1]: It would be quite too much to expect tho
488 ----------------------------
489 jrandom:$apr1$3p1.....$FQW6RceW5QhJ2blWDQgKn0
490 jconstant:$apr1$jp1.....$Usrqji1c9H6AbOxOGAzzb0
491+ JRANDOM:$apr1$3p1.....$FQW6RceW5QhJ2blWDQgKn0
492+ JCONSTANT:$apr1$jp1.....$Usrqji1c9H6AbOxOGAzzb0
493 ----------------------------
494
495
496Index: subversion/tests/cmdline/davautocheck.sh
497===================================================================
498--- a/subversion/tests/cmdline/davautocheck.sh (revision 1691883)
499+++ b/subversion/tests/cmdline/davautocheck.sh (working copy)
500@@ -289,8 +289,6 @@ LOAD_MOD_AUTHN_CORE="$(get_loadmodule_config mod_a
501 || fail "Authn_Core module not found."
502 LOAD_MOD_AUTHZ_CORE="$(get_loadmodule_config mod_authz_core)" \
503 || fail "Authz_Core module not found."
504-LOAD_MOD_AUTHZ_HOST="$(get_loadmodule_config mod_authz_host)" \
505- || fail "Authz_Host module not found."
506 LOAD_MOD_UNIXD=$(get_loadmodule_config mod_unixd) \
507 || fail "UnixD module not found"
508 }
509@@ -298,6 +296,10 @@ LOAD_MOD_AUTHN_FILE="$(get_loadmodule_config mod_a
510 || fail "Authn_File module not found."
511 LOAD_MOD_AUTHZ_USER="$(get_loadmodule_config mod_authz_user)" \
512 || fail "Authz_User module not found."
513+LOAD_MOD_AUTHZ_GROUPFILE="$(get_loadmodule_config mod_authz_groupfile)" \
514+ || fail "Authz_GroupFile module not found."
515+LOAD_MOD_AUTHZ_HOST="$(get_loadmodule_config mod_authz_host)" \
516+ || fail "Authz_Host module not found."
517 }
518 if [ ${APACHE_MPM:+set} ]; then
519 LOAD_MOD_MPM=$(get_loadmodule_config mod_mpm_$APACHE_MPM) \
520@@ -328,6 +330,7 @@ HTTPD_ERROR_LOG="$HTTPD_ROOT/error_log"
521 HTTPD_MIME_TYPES="$HTTPD_ROOT/mime.types"
522 BASE_URL="http://localhost:$HTTPD_PORT"
523 HTTPD_USERS="$HTTPD_ROOT/users"
524+HTTPD_GROUPS="$HTTPD_ROOT/groups"
525
526 mkdir "$HTTPD_ROOT" \
527 || fail "couldn't create temporary directory '$HTTPD_ROOT'"
528@@ -388,6 +391,14 @@ fi
529 say "Adding users for lock authentication"
530 $HTPASSWD -bc $HTTPD_USERS jrandom rayjandom
531 $HTPASSWD -b $HTTPD_USERS jconstant rayjandom
532+$HTPASSWD -b $HTTPD_USERS JRANDOM rayjandom
533+$HTPASSWD -b $HTTPD_USERS JCONSTANT rayjandom
534+
535+say "Adding groups for mod_authz_svn tests"
536+cat > "$HTTPD_GROUPS" <<__EOF__
537+random: jrandom
538+constant: jconstant
539+__EOF__
540
541 touch $HTTPD_MIME_TYPES
542
543@@ -405,7 +416,9 @@ $LOAD_MOD_AUTHN_CORE
544 $LOAD_MOD_AUTHN_FILE
545 $LOAD_MOD_AUTHZ_CORE
546 $LOAD_MOD_AUTHZ_USER
547+$LOAD_MOD_AUTHZ_GROUPFILE
548 $LOAD_MOD_AUTHZ_HOST
549+$LOAD_MOD_ACCESS_COMPAT
550 LoadModule authz_svn_module "$MOD_AUTHZ_SVN"
551
552 __EOF__
553@@ -497,6 +510,161 @@ CustomLog "$HTTPD_ROOT/ops" "%t %u %{SVN
554 SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
555 ${SVN_PATH_AUTHZ_LINE}
556 </Location>
557+<Location /authz-test-work/anon>
558+ DAV svn
559+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
560+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
561+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
562+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
563+ SVNListParentPath On
564+ # This may seem unnecessary but granting access to everyone here is necessary
565+ # to exercise a bug with httpd 2.3.x+. The "Require all granted" syntax is
566+ # new to 2.3.x+ which we can detect with the mod_authz_core.c module
567+ # signature. Use the "Allow from all" syntax with older versions for symmetry.
568+ <IfModule mod_authz_core.c>
569+ Require all granted
570+ </IfModule>
571+ <IfModule !mod_authz_core.c>
572+ Allow from all
573+ </IfMOdule>
574+ ${SVN_PATH_AUTHZ_LINE}
575+</Location>
576+<Location /authz-test-work/mixed>
577+ DAV svn
578+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
579+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
580+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
581+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
582+ SVNListParentPath On
583+ AuthType Basic
584+ AuthName "Subversion Repository"
585+ AuthUserFile $HTTPD_USERS
586+ Require valid-user
587+ Satisfy Any
588+ ${SVN_PATH_AUTHZ_LINE}
589+</Location>
590+<Location /authz-test-work/mixed-noauthwhenanon>
591+ DAV svn
592+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
593+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
594+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
595+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
596+ SVNListParentPath On
597+ AuthType Basic
598+ AuthName "Subversion Repository"
599+ AuthUserFile $HTTPD_USERS
600+ Require valid-user
601+ AuthzSVNNoAuthWhenAnonymousAllowed On
602+ SVNPathAuthz On
603+</Location>
604+<Location /authz-test-work/authn>
605+ DAV svn
606+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
607+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
608+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
609+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
610+ SVNListParentPath On
611+ AuthType Basic
612+ AuthName "Subversion Repository"
613+ AuthUserFile $HTTPD_USERS
614+ Require valid-user
615+ ${SVN_PATH_AUTHZ_LINE}
616+</Location>
617+<Location /authz-test-work/authn-anonoff>
618+ DAV svn
619+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
620+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
621+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
622+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
623+ SVNListParentPath On
624+ AuthType Basic
625+ AuthName "Subversion Repository"
626+ AuthUserFile $HTTPD_USERS
627+ Require valid-user
628+ AuthzSVNAnonymous Off
629+ SVNPathAuthz On
630+</Location>
631+<Location /authz-test-work/authn-lcuser>
632+ DAV svn
633+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
634+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
635+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
636+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
637+ SVNListParentPath On
638+ AuthType Basic
639+ AuthName "Subversion Repository"
640+ AuthUserFile $HTTPD_USERS
641+ Require valid-user
642+ AuthzForceUsernameCase Lower
643+ ${SVN_PATH_AUTHZ_LINE}
644+</Location>
645+<Location /authz-test-work/authn-lcuser>
646+ DAV svn
647+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
648+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
649+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
650+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
651+ SVNListParentPath On
652+ AuthType Basic
653+ AuthName "Subversion Repository"
654+ AuthUserFile $HTTPD_USERS
655+ Require valid-user
656+ AuthzForceUsernameCase Lower
657+ ${SVN_PATH_AUTHZ_LINE}
658+</Location>
659+<Location /authz-test-work/authn-group>
660+ DAV svn
661+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
662+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
663+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
664+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
665+ SVNListParentPath On
666+ AuthType Basic
667+ AuthName "Subversion Repository"
668+ AuthUserFile $HTTPD_USERS
669+ AuthGroupFile $HTTPD_GROUPS
670+ Require group random
671+ AuthzSVNAuthoritative Off
672+ SVNPathAuthz On
673+</Location>
674+<IfModule mod_authz_core.c>
675+ <Location /authz-test-work/sallrany>
676+ DAV svn
677+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
678+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
679+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
680+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
681+ SVNListParentPath On
682+ AuthType Basic
683+ AuthName "Subversion Repository"
684+ AuthUserFile $HTTPD_USERS
685+ AuthzSendForbiddenOnFailure On
686+ Satisfy All
687+ <RequireAny>
688+ Require valid-user
689+ Require expr req('ALLOW') == '1'
690+ </RequireAny>
691+ ${SVN_PATH_AUTHZ_LINE}
692+ </Location>
693+ <Location /authz-test-work/sallrall>
694+ DAV svn
695+ SVNParentPath "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/local_tmp"
696+ AuthzSVNAccessFile "$ABS_BUILDDIR/subversion/tests/cmdline/svn-test-work/authz"
697+ SVNAdvertiseV2Protocol ${ADVERTISE_V2_PROTOCOL}
698+ SVNCacheRevProps ${CACHE_REVPROPS_SETTING}
699+ SVNListParentPath On
700+ AuthType Basic
701+ AuthName "Subversion Repository"
702+ AuthUserFile $HTTPD_USERS
703+ AuthzSendForbiddenOnFailure On
704+ Satisfy All
705+ <RequireAll>
706+ Require valid-user
707+ Require expr req('ALLOW') == '1'
708+ </RequireAll>
709+ ${SVN_PATH_AUTHZ_LINE}
710+ </Location>
711+</IfModule>
712 RedirectMatch permanent ^/svn-test-work/repositories/REDIRECT-PERM-(.*)\$ /svn-test-work/repositories/\$1
713 RedirectMatch ^/svn-test-work/repositories/REDIRECT-TEMP-(.*)\$ /svn-test-work/repositories/\$1
714 __EOF__
715Index: subversion/tests/cmdline/mod_authz_svn_tests.py
716===================================================================
717--- a/subversion/tests/cmdline/mod_authz_svn_tests.py (nonexistent)
718+++ b/subversion/tests/cmdline/mod_authz_svn_tests.py (working copy)
719@@ -0,0 +1,1073 @@
720+#!/usr/bin/env python
721+#
722+# mod_authz_svn_tests.py: testing mod_authz_svn
723+#
724+# Subversion is a tool for revision control.
725+# See http://subversion.apache.org for more information.
726+#
727+# ====================================================================
728+# Licensed to the Apache Software Foundation (ASF) under one
729+# or more contributor license agreements. See the NOTICE file
730+# distributed with this work for additional information
731+# regarding copyright ownership. The ASF licenses this file
732+# to you under the Apache License, Version 2.0 (the
733+# "License"); you may not use this file except in compliance
734+# with the License. You may obtain a copy of the License at
735+#
736+# http://www.apache.org/licenses/LICENSE-2.0
737+#
738+# Unless required by applicable law or agreed to in writing,
739+# software distributed under the License is distributed on an
740+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
741+# KIND, either express or implied. See the License for the
742+# specific language governing permissions and limitations
743+# under the License.
744+######################################################################
745+
746+# General modules
747+import os, re, logging
748+
749+logger = logging.getLogger()
750+
751+# Our testing module
752+import svntest
753+
754+# (abbreviation)
755+Skip = svntest.testcase.Skip_deco
756+SkipUnless = svntest.testcase.SkipUnless_deco
757+XFail = svntest.testcase.XFail_deco
758+Issues = svntest.testcase.Issues_deco
759+Issue = svntest.testcase.Issue_deco
760+Wimp = svntest.testcase.Wimp_deco
761+
762+ls_of_D_no_H = '''<html><head><title>repos - Revision 1: /A/D</title></head>
763+<body>
764+ <h2>repos - Revision 1: /A/D</h2>
765+ <ul>
766+ <li><a href="../">..</a></li>
767+ <li><a href="G/">G/</a></li>
768+ <li><a href="gamma">gamma</a></li>
769+ </ul>
770+</body></html>'''
771+
772+ls_of_D_H = '''<html><head><title>repos - Revision 1: /A/D</title></head>
773+<body>
774+ <h2>repos - Revision 1: /A/D</h2>
775+ <ul>
776+ <li><a href="../">..</a></li>
777+ <li><a href="G/">G/</a></li>
778+ <li><a href="H/">H/</a></li>
779+ <li><a href="gamma">gamma</a></li>
780+ </ul>
781+</body></html>'''
782+
783+ls_of_H = '''<html><head><title>repos - Revision 1: /A/D/H</title></head>
784+<body>
785+ <h2>repos - Revision 1: /A/D/H</h2>
786+ <ul>
787+ <li><a href="../">..</a></li>
788+ <li><a href="chi">chi</a></li>
789+ <li><a href="omega">omega</a></li>
790+ <li><a href="psi">psi</a></li>
791+ </ul>
792+</body></html>'''
793+
794+user1 = svntest.main.wc_author
795+user1_upper = user1.upper()
796+user1_pass = svntest.main.wc_passwd
797+user1_badpass = 'XXX'
798+assert user1_pass != user1_badpass, "Passwords can't match"
799+user2 = svntest.main.wc_author2
800+user2_upper = user2.upper()
801+user2_pass = svntest.main.wc_passwd
802+user2_badpass = 'XXX'
803+assert user2_pass != user2_badpass, "Passwords can't match"
804+
805+def write_authz_file(sbox):
806+ svntest.main.write_authz_file(sbox, {
807+ '/': '$anonymous = r\n' +
808+ 'jrandom = rw\n' +
809+ 'jconstant = rw',
810+ '/A/D/H': '$anonymous =\n' +
811+ '$authenticated =\n' +
812+ 'jrandom = rw'
813+ })
814+
815+def write_authz_file_groups(sbox):
816+ authz_name = sbox.authz_name()
817+ svntest.main.write_authz_file(sbox,{
818+ '/': '* =',
819+ })
820+
821+def verify_get(test_area_url, path, user, pw,
822+ expected_status, expected_body, headers):
823+ import httplib
824+ from urlparse import urlparse
825+ import base64
826+
827+ req_url = test_area_url + path
828+
829+ loc = urlparse(req_url)
830+
831+ if loc.scheme == 'http':
832+ h = httplib.HTTPConnection(loc.hostname, loc.port)
833+ else:
834+ h = httplib.HTTPSConnection(loc.hostname, loc.port)
835+
836+ if headers is None:
837+ headers = {}
838+
839+ if user and pw:
840+ auth_info = user + ':' + pw
841+ headers['Authorization'] = 'Basic ' + base64.b64encode(auth_info)
842+ else:
843+ auth_info = "anonymous"
844+
845+ h.request('GET', req_url, None, headers)
846+
847+ r = h.getresponse()
848+
849+ actual_status = r.status
850+ if expected_status and expected_status != actual_status:
851+
852+ logger.warn("Expected status '" + str(expected_status) +
853+ "' but got '" + str(actual_status) +
854+ "' on url '" + req_url + "' (" +
855+ auth_info + ").")
856+ raise svntest.Failure
857+
858+ if expected_body:
859+ actual_body = r.read()
860+ if expected_body != actual_body:
861+ logger.warn("Expected body:")
862+ logger.warn(expected_body)
863+ logger.warn("But got:")
864+ logger.warn(actual_body)
865+ logger.warn("on url '" + req_url + "' (" + auth_info + ").")
866+ raise svntest.Failure
867+
868+def verify_gets(test_area_url, tests):
869+ for test in tests:
870+ verify_get(test_area_url, test['path'], test.get('user'), test.get('pw'),
871+ test['status'], test.get('body'), test.get('headers'))
872+
873+
874+######################################################################
875+# Tests
876+#
877+# Each test must return on success or raise on failure.
878+
879+
880+#----------------------------------------------------------------------
881+
882+
883+@SkipUnless(svntest.main.is_ra_type_dav)
884+def anon(sbox):
885+ "test anonymous access"
886+ sbox.build(read_only = True, create_wc = False)
887+
888+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
889+ '/authz-test-work/anon')
890+
891+ write_authz_file(sbox)
892+
893+ anon_tests = (
894+ { 'path': '', 'status': 301 },
895+ { 'path': '/', 'status': 200 },
896+ { 'path': '/repos', 'status': 301 },
897+ { 'path': '/repos/', 'status': 200 },
898+ { 'path': '/repos/A', 'status': 301 },
899+ { 'path': '/repos/A/', 'status': 200 },
900+ { 'path': '/repos/A/D', 'status': 301 },
901+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H },
902+ { 'path': '/repos/A/D/gamma', 'status': 200 },
903+ { 'path': '/repos/A/D/H', 'status': 403 },
904+ { 'path': '/repos/A/D/H/', 'status': 403 },
905+ { 'path': '/repos/A/D/H/chi', 'status': 403 },
906+ # auth isn't configured so nothing should change when passing
907+ # authn details
908+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
909+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
910+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
911+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
912+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
913+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
914+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
915+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
916+ 'user': user1, 'pw': user1_pass},
917+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
918+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user1, 'pw': user1_pass},
919+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user1, 'pw': user1_pass},
920+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user1, 'pw': user1_pass},
921+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_badpass},
922+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_badpass},
923+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_badpass},
924+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_badpass},
925+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_badpass},
926+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_badpass},
927+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_badpass},
928+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
929+ 'user': user1, 'pw': user1_badpass},
930+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_badpass},
931+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user1, 'pw': user1_badpass},
932+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user1, 'pw': user1_badpass},
933+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user1, 'pw': user1_badpass},
934+ { 'path': '', 'status': 301, 'user': user2, 'pw': user1_pass},
935+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user1_pass},
936+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user1_pass},
937+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user1_pass},
938+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user1_pass},
939+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user1_pass},
940+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user1_pass},
941+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
942+ 'user': user2, 'pw': user1_pass},
943+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass},
944+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
945+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
946+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
947+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_badpass},
948+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_badpass},
949+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_badpass},
950+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_badpass},
951+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_badpass},
952+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_badpass},
953+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_badpass},
954+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
955+ 'user': user2, 'pw': user2_badpass},
956+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_badpass},
957+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_badpass},
958+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_badpass},
959+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_badpass},
960+ )
961+
962+ verify_gets(test_area_url, anon_tests)
963+
964+
965+@SkipUnless(svntest.main.is_ra_type_dav)
966+def mixed(sbox):
967+ "test mixed anonymous and authenticated access"
968+ sbox.build(read_only = True, create_wc = False)
969+
970+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
971+ '/authz-test-work/mixed')
972+
973+ write_authz_file(sbox)
974+
975+ mixed_tests = (
976+ { 'path': '', 'status': 301, },
977+ { 'path': '/', 'status': 200, },
978+ { 'path': '/repos', 'status': 301, },
979+ { 'path': '/repos/', 'status': 200, },
980+ { 'path': '/repos/A', 'status': 301, },
981+ { 'path': '/repos/A/', 'status': 200, },
982+ { 'path': '/repos/A/D', 'status': 301, },
983+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
984+ },
985+ { 'path': '/repos/A/D/gamma', 'status': 200, },
986+ { 'path': '/repos/A/D/H', 'status': 401, },
987+ { 'path': '/repos/A/D/H/', 'status': 401, },
988+ { 'path': '/repos/A/D/H/chi', 'status': 401, },
989+ # auth is configured and user1 is allowed access to H
990+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
991+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
992+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
993+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
994+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
995+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
996+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
997+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
998+ 'user': user1, 'pw': user1_pass},
999+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
1000+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass},
1001+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass},
1002+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass},
1003+ # try with the wrong password for user1
1004+ { 'path': '', 'status': 401, 'user': user1, 'pw': user1_badpass},
1005+ { 'path': '/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1006+ { 'path': '/repos', 'status': 401, 'user': user1, 'pw': user1_badpass},
1007+ { 'path': '/repos/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1008+ { 'path': '/repos/A', 'status': 401, 'user': user1, 'pw': user1_badpass},
1009+ { 'path': '/repos/A/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1010+ { 'path': '/repos/A/D', 'status': 401, 'user': user1, 'pw': user1_badpass},
1011+ { 'path': '/repos/A/D/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1012+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user1, 'pw': user1_badpass},
1013+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass},
1014+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1015+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass},
1016+ # auth is configured and user2 is not allowed access to H
1017+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass},
1018+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass},
1019+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass},
1020+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass},
1021+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass},
1022+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass},
1023+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass},
1024+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1025+ 'user': user2, 'pw': user2_pass},
1026+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass},
1027+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
1028+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
1029+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
1030+ # try with the wrong password for user2
1031+ { 'path': '', 'status': 401, 'user': user2, 'pw': user2_badpass},
1032+ { 'path': '/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1033+ { 'path': '/repos', 'status': 401, 'user': user2, 'pw': user2_badpass},
1034+ { 'path': '/repos/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1035+ { 'path': '/repos/A', 'status': 401, 'user': user2, 'pw': user2_badpass},
1036+ { 'path': '/repos/A/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1037+ { 'path': '/repos/A/D', 'status': 401, 'user': user2, 'pw': user2_badpass},
1038+ { 'path': '/repos/A/D/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1039+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user2, 'pw': user2_badpass},
1040+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass},
1041+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1042+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass},
1043+ )
1044+
1045+ verify_gets(test_area_url, mixed_tests)
1046+
1047+@SkipUnless(svntest.main.is_ra_type_dav)
1048+@XFail(svntest.main.is_httpd_authz_provider_enabled)
1049+# uses the AuthzSVNNoAuthWhenAnonymousAllowed On directive
1050+# this is broken with httpd 2.3.x+ since it requires the auth system to accept
1051+# r->user == NULL and there is a test for this in server/request.c now. It
1052+# was intended as a workaround for the lack of Satisfy Any in 2.3.x+ which
1053+# was resolved by httpd with mod_access_compat in 2.3.x+.
1054+def mixed_noauthwhenanon(sbox):
1055+ "test mixed with noauthwhenanon directive"
1056+ sbox.build(read_only = True, create_wc = False)
1057+
1058+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1059+ '/authz-test-work/mixed-noauthwhenanon')
1060+
1061+ write_authz_file(sbox)
1062+
1063+ noauthwhenanon_tests = (
1064+ { 'path': '', 'status': 301, },
1065+ { 'path': '/', 'status': 200, },
1066+ { 'path': '/repos', 'status': 301, },
1067+ { 'path': '/repos/', 'status': 200, },
1068+ { 'path': '/repos/A', 'status': 301, },
1069+ { 'path': '/repos/A/', 'status': 200, },
1070+ { 'path': '/repos/A/D', 'status': 301, },
1071+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1072+ },
1073+ { 'path': '/repos/A/D/gamma', 'status': 200, },
1074+ { 'path': '/repos/A/D/H', 'status': 401, },
1075+ { 'path': '/repos/A/D/H/', 'status': 401, },
1076+ { 'path': '/repos/A/D/H/chi', 'status': 401, },
1077+ # auth is configured and user1 is allowed access to H
1078+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
1079+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
1080+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
1081+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
1082+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
1083+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
1084+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
1085+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1086+ 'user': user1, 'pw': user1_pass},
1087+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
1088+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass},
1089+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass},
1090+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass},
1091+ # try with the wrong password for user1
1092+ # note that unlike doing this with Satisfy Any this case
1093+ # actually provides anon access when provided with an invalid
1094+ # password
1095+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_badpass},
1096+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_badpass},
1097+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_badpass},
1098+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_badpass},
1099+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_badpass},
1100+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_badpass},
1101+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_badpass},
1102+ { 'path': '/repos/A/D/', 'status': 200, 'user': user1, 'pw': user1_badpass},
1103+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_badpass},
1104+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass},
1105+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1106+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass},
1107+ # auth is configured and user2 is not allowed access to H
1108+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass},
1109+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass},
1110+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass},
1111+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass},
1112+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass},
1113+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass},
1114+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass},
1115+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1116+ 'user': user2, 'pw': user2_pass},
1117+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass},
1118+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
1119+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
1120+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
1121+ # try with the wrong password for user2
1122+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_badpass},
1123+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_badpass},
1124+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_badpass},
1125+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_badpass},
1126+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_badpass},
1127+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_badpass},
1128+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_badpass},
1129+ { 'path': '/repos/A/D/', 'status': 200, 'user': user2, 'pw': user2_badpass},
1130+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_badpass},
1131+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass},
1132+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1133+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass},
1134+ )
1135+
1136+ verify_gets(test_area_url, noauthwhenanon_tests)
1137+
1138+
1139+@SkipUnless(svntest.main.is_ra_type_dav)
1140+def authn(sbox):
1141+ "test authenticated only access"
1142+ sbox.build(read_only = True, create_wc = False)
1143+
1144+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1145+ '/authz-test-work/authn')
1146+
1147+ write_authz_file(sbox)
1148+
1149+ authn_tests = (
1150+ { 'path': '', 'status': 401, },
1151+ { 'path': '/', 'status': 401, },
1152+ { 'path': '/repos', 'status': 401, },
1153+ { 'path': '/repos/', 'status': 401, },
1154+ { 'path': '/repos/A', 'status': 401, },
1155+ { 'path': '/repos/A/', 'status': 401, },
1156+ { 'path': '/repos/A/D', 'status': 401, },
1157+ { 'path': '/repos/A/D/', 'status': 401, },
1158+ { 'path': '/repos/A/D/gamma', 'status': 401, },
1159+ { 'path': '/repos/A/D/H', 'status': 401, },
1160+ { 'path': '/repos/A/D/H/', 'status': 401, },
1161+ { 'path': '/repos/A/D/H/chi', 'status': 401, },
1162+ # auth is configured and user1 is allowed access to H
1163+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
1164+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
1165+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
1166+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
1167+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
1168+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
1169+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
1170+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1171+ 'user': user1, 'pw': user1_pass},
1172+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
1173+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass},
1174+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass},
1175+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass},
1176+ # try with upper case username for user1
1177+ { 'path': '', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1178+ { 'path': '/', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1179+ { 'path': '/repos', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1180+ { 'path': '/repos/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1181+ { 'path': '/repos/A', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1182+ { 'path': '/repos/A/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1183+ { 'path': '/repos/A/D', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1184+ { 'path': '/repos/A/D/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1185+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1186+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1187+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1188+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1189+ # try with the wrong password for user1
1190+ { 'path': '', 'status': 401, 'user': user1, 'pw': user1_badpass},
1191+ { 'path': '/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1192+ { 'path': '/repos', 'status': 401, 'user': user1, 'pw': user1_badpass},
1193+ { 'path': '/repos/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1194+ { 'path': '/repos/A', 'status': 401, 'user': user1, 'pw': user1_badpass},
1195+ { 'path': '/repos/A/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1196+ { 'path': '/repos/A/D', 'status': 401, 'user': user1, 'pw': user1_badpass},
1197+ { 'path': '/repos/A/D/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1198+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user1, 'pw': user1_badpass},
1199+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass},
1200+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1201+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass},
1202+ # auth is configured and user2 is not allowed access to H
1203+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass},
1204+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass},
1205+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass},
1206+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass},
1207+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass},
1208+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass},
1209+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass},
1210+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1211+ 'user': user2, 'pw': user2_pass},
1212+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass},
1213+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
1214+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
1215+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
1216+ # try with upper case username for user2
1217+ { 'path': '', 'status': 301, 'user': user2_upper, 'pw': user2_pass},
1218+ { 'path': '/', 'status': 200, 'user': user2_upper, 'pw': user2_pass},
1219+ { 'path': '/repos', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1220+ { 'path': '/repos/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1221+ { 'path': '/repos/A', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1222+ { 'path': '/repos/A/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1223+ { 'path': '/repos/A/D', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1224+ { 'path': '/repos/A/D/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1225+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1226+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1227+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1228+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1229+ # try with the wrong password for user2
1230+ { 'path': '', 'status': 401, 'user': user2, 'pw': user2_badpass},
1231+ { 'path': '/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1232+ { 'path': '/repos', 'status': 401, 'user': user2, 'pw': user2_badpass},
1233+ { 'path': '/repos/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1234+ { 'path': '/repos/A', 'status': 401, 'user': user2, 'pw': user2_badpass},
1235+ { 'path': '/repos/A/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1236+ { 'path': '/repos/A/D', 'status': 401, 'user': user2, 'pw': user2_badpass},
1237+ { 'path': '/repos/A/D/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1238+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user2, 'pw': user2_badpass},
1239+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass},
1240+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1241+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass},
1242+ )
1243+
1244+ verify_gets(test_area_url, authn_tests)
1245+
1246+@SkipUnless(svntest.main.is_ra_type_dav)
1247+def authn_anonoff(sbox):
1248+ "test authenticated only access with anonoff"
1249+ sbox.build(read_only = True, create_wc = False)
1250+
1251+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1252+ '/authz-test-work/authn-anonoff')
1253+
1254+ write_authz_file(sbox)
1255+
1256+ anonoff_tests = (
1257+ { 'path': '', 'status': 401, },
1258+ { 'path': '/', 'status': 401, },
1259+ { 'path': '/repos', 'status': 401, },
1260+ { 'path': '/repos/', 'status': 401, },
1261+ { 'path': '/repos/A', 'status': 401, },
1262+ { 'path': '/repos/A/', 'status': 401, },
1263+ { 'path': '/repos/A/D', 'status': 401, },
1264+ { 'path': '/repos/A/D/', 'status': 401, },
1265+ { 'path': '/repos/A/D/gamma', 'status': 401, },
1266+ { 'path': '/repos/A/D/H', 'status': 401, },
1267+ { 'path': '/repos/A/D/H/', 'status': 401, },
1268+ { 'path': '/repos/A/D/H/chi', 'status': 401, },
1269+ # auth is configured and user1 is allowed access to H
1270+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
1271+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
1272+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
1273+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
1274+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
1275+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
1276+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
1277+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1278+ 'user': user1, 'pw': user1_pass},
1279+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
1280+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass},
1281+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass},
1282+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass},
1283+ # try with upper case username for user1
1284+ { 'path': '', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1285+ { 'path': '/', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1286+ { 'path': '/repos', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1287+ { 'path': '/repos/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1288+ { 'path': '/repos/A', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1289+ { 'path': '/repos/A/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1290+ { 'path': '/repos/A/D', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1291+ { 'path': '/repos/A/D/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1292+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1293+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1294+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1295+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user1_upper, 'pw': user1_pass},
1296+ # try with the wrong password for user1
1297+ { 'path': '', 'status': 401, 'user': user1, 'pw': user1_badpass},
1298+ { 'path': '/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1299+ { 'path': '/repos', 'status': 401, 'user': user1, 'pw': user1_badpass},
1300+ { 'path': '/repos/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1301+ { 'path': '/repos/A', 'status': 401, 'user': user1, 'pw': user1_badpass},
1302+ { 'path': '/repos/A/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1303+ { 'path': '/repos/A/D', 'status': 401, 'user': user1, 'pw': user1_badpass},
1304+ { 'path': '/repos/A/D/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1305+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user1, 'pw': user1_badpass},
1306+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass},
1307+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1308+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass},
1309+ # auth is configured and user2 is not allowed access to H
1310+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass},
1311+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass},
1312+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass},
1313+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass},
1314+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass},
1315+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass},
1316+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass},
1317+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1318+ 'user': user2, 'pw': user2_pass},
1319+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass},
1320+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
1321+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
1322+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
1323+ # try with upper case username for user2
1324+ { 'path': '', 'status': 301, 'user': user2_upper, 'pw': user2_pass},
1325+ { 'path': '/', 'status': 200, 'user': user2_upper, 'pw': user2_pass},
1326+ { 'path': '/repos', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1327+ { 'path': '/repos/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1328+ { 'path': '/repos/A', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1329+ { 'path': '/repos/A/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1330+ { 'path': '/repos/A/D', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1331+ { 'path': '/repos/A/D/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1332+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1333+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1334+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1335+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1336+ # try with the wrong password for user2
1337+ { 'path': '', 'status': 401, 'user': user2, 'pw': user2_badpass},
1338+ { 'path': '/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1339+ { 'path': '/repos', 'status': 401, 'user': user2, 'pw': user2_badpass},
1340+ { 'path': '/repos/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1341+ { 'path': '/repos/A', 'status': 401, 'user': user2, 'pw': user2_badpass},
1342+ { 'path': '/repos/A/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1343+ { 'path': '/repos/A/D', 'status': 401, 'user': user2, 'pw': user2_badpass},
1344+ { 'path': '/repos/A/D/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1345+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user2, 'pw': user2_badpass},
1346+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass},
1347+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1348+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass},
1349+ )
1350+
1351+ verify_gets(test_area_url, anonoff_tests)
1352+
1353+@SkipUnless(svntest.main.is_ra_type_dav)
1354+def authn_lcuser(sbox):
1355+ "test authenticated only access with lcuser"
1356+ sbox.build(read_only = True, create_wc = False)
1357+
1358+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1359+ '/authz-test-work/authn-lcuser')
1360+
1361+ write_authz_file(sbox)
1362+
1363+ lcuser_tests = (
1364+ # try with upper case username for user1 (works due to lcuser option)
1365+ { 'path': '', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1366+ { 'path': '/', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1367+ { 'path': '/repos', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1368+ { 'path': '/repos/', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1369+ { 'path': '/repos/A', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1370+ { 'path': '/repos/A/', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1371+ { 'path': '/repos/A/D', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1372+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1373+ 'user': user1_upper, 'pw': user1_pass},
1374+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1375+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1_upper, 'pw': user1_pass},
1376+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1_upper, 'pw': user1_pass},
1377+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1_upper, 'pw': user1_pass},
1378+ # try with upper case username for user2 (works due to lcuser option)
1379+ { 'path': '', 'status': 301, 'user': user2_upper, 'pw': user2_pass},
1380+ { 'path': '/', 'status': 200, 'user': user2_upper, 'pw': user2_pass},
1381+ { 'path': '/repos', 'status': 301, 'user': user2_upper, 'pw': user2_pass},
1382+ { 'path': '/repos/', 'status': 200, 'user': user2_upper, 'pw': user2_pass},
1383+ { 'path': '/repos/A', 'status': 301, 'user': user2_upper, 'pw': user2_pass},
1384+ { 'path': '/repos/A/', 'status': 200, 'user': user2_upper, 'pw': user2_pass},
1385+ { 'path': '/repos/A/D', 'status': 301, 'user': user2_upper, 'pw': user2_pass},
1386+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1387+ 'user': user2_upper, 'pw': user2_pass},
1388+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2_upper, 'pw': user2_pass},
1389+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1390+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1391+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2_upper, 'pw': user2_pass},
1392+ )
1393+
1394+ verify_gets(test_area_url, lcuser_tests)
1395+
1396+# authenticated access only by group - a excuse to use AuthzSVNAuthoritative Off
1397+# this is terribly messed up, Require group runs after mod_authz_svn.
1398+# so if mod_authz_svn grants the access then it doesn't matter what the group
1399+# requirement says. If we reject the access then you can use the AuthzSVNAuthoritative Off
1400+# directive to fall through to the group check. Overall the behavior of setups like this
1401+# is almost guaranteed to not be what users expect.
1402+@SkipUnless(svntest.main.is_ra_type_dav)
1403+def authn_group(sbox):
1404+ "test authenticated only access via groups"
1405+ sbox.build(read_only = True, create_wc = False)
1406+
1407+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1408+ '/authz-test-work/authn-group')
1409+
1410+ # Can't use write_authz_file() as most tests because we want to deny all
1411+ # access with mod_authz_svn so the tests fall through to the group handling
1412+ authz_name = sbox.authz_name()
1413+ svntest.main.write_authz_file(sbox, {
1414+ '/': '* =',
1415+ })
1416+
1417+ group_tests = (
1418+ { 'path': '', 'status': 401, },
1419+ { 'path': '/', 'status': 401, },
1420+ { 'path': '/repos', 'status': 401, },
1421+ { 'path': '/repos/', 'status': 401, },
1422+ { 'path': '/repos/A', 'status': 401, },
1423+ { 'path': '/repos/A/', 'status': 401, },
1424+ { 'path': '/repos/A/D', 'status': 401, },
1425+ { 'path': '/repos/A/D/', 'status': 401, },
1426+ { 'path': '/repos/A/D/gamma', 'status': 401, },
1427+ { 'path': '/repos/A/D/H', 'status': 401, },
1428+ { 'path': '/repos/A/D/H/', 'status': 401, },
1429+ { 'path': '/repos/A/D/H/chi', 'status': 401, },
1430+ # auth is configured and user1 is allowed access repo including H
1431+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
1432+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
1433+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
1434+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
1435+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
1436+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
1437+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
1438+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1439+ 'user': user1, 'pw': user1_pass},
1440+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
1441+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass},
1442+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass},
1443+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass},
1444+ )
1445+
1446+ verify_gets(test_area_url, group_tests)
1447+
1448+# This test exists to validate our behavior when used with the new authz
1449+# provider system introduced in httpd 2.3.x. The Satisfy directive
1450+# determines how older authz hooks are combined and the RequireA(ll|ny)
1451+# blocks handles how new authz providers are combined. The overall results of
1452+# all the authz providers (combined per the Require* blocks) are then
1453+# combined with the other authz hooks via the Satisfy directive.
1454+# Meaning this test requires that mod_authz_svn says yes and there is
1455+# either a valid user or the ALLOW header is 1. The header may seem
1456+# like a silly test but it's easier to excercise than say a host directive
1457+# in a repeatable test.
1458+@SkipUnless(svntest.main.is_httpd_authz_provider_enabled)
1459+def authn_sallrany(sbox):
1460+ "test satisfy all require any config"
1461+ sbox.build(read_only = True, create_wc = False)
1462+
1463+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1464+ '/authz-test-work/sallrany')
1465+
1466+ write_authz_file(sbox)
1467+
1468+ allow_header = { 'ALLOW': '1' }
1469+
1470+ sallrany_tests = (
1471+ #anon access isn't allowed without ALLOW header
1472+ { 'path': '', 'status': 401, },
1473+ { 'path': '/', 'status': 401, },
1474+ { 'path': '/repos', 'status': 401, },
1475+ { 'path': '/repos/', 'status': 401, },
1476+ { 'path': '/repos/A', 'status': 401, },
1477+ { 'path': '/repos/A/', 'status': 401, },
1478+ { 'path': '/repos/A/D', 'status': 401, },
1479+ { 'path': '/repos/A/D/', 'status': 401, },
1480+ { 'path': '/repos/A/D/gamma', 'status': 401, },
1481+ { 'path': '/repos/A/D/H', 'status': 401, },
1482+ { 'path': '/repos/A/D/H/', 'status': 401, },
1483+ { 'path': '/repos/A/D/H/chi', 'status': 401, },
1484+ # auth is configured and user1 is allowed access repo including H
1485+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass},
1486+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass},
1487+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass},
1488+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass},
1489+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass},
1490+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass},
1491+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass},
1492+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1493+ 'user': user1, 'pw': user1_pass},
1494+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass},
1495+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass},
1496+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass},
1497+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass},
1498+ # try with the wrong password for user1
1499+ { 'path': '', 'status': 401, 'user': user1, 'pw': user1_badpass},
1500+ { 'path': '/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1501+ { 'path': '/repos', 'status': 401, 'user': user1, 'pw': user1_badpass},
1502+ { 'path': '/repos/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1503+ { 'path': '/repos/A', 'status': 401, 'user': user1, 'pw': user1_badpass},
1504+ { 'path': '/repos/A/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1505+ { 'path': '/repos/A/D', 'status': 401, 'user': user1, 'pw': user1_badpass},
1506+ { 'path': '/repos/A/D/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1507+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user1, 'pw': user1_badpass},
1508+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass},
1509+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass},
1510+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass},
1511+ # auth is configured and user2 is not allowed access to H
1512+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass},
1513+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass},
1514+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass},
1515+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass},
1516+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass},
1517+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass},
1518+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass},
1519+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1520+ 'user': user2, 'pw': user2_pass},
1521+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass},
1522+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
1523+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
1524+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
1525+ # try with the wrong password for user2
1526+ { 'path': '', 'status': 401, 'user': user2, 'pw': user2_badpass},
1527+ { 'path': '/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1528+ { 'path': '/repos', 'status': 401, 'user': user2, 'pw': user2_badpass},
1529+ { 'path': '/repos/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1530+ { 'path': '/repos/A', 'status': 401, 'user': user2, 'pw': user2_badpass},
1531+ { 'path': '/repos/A/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1532+ { 'path': '/repos/A/D', 'status': 401, 'user': user2, 'pw': user2_badpass},
1533+ { 'path': '/repos/A/D/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1534+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user2, 'pw': user2_badpass},
1535+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass},
1536+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass},
1537+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass},
1538+ # anon is allowed with the ALLOW header
1539+ { 'path': '', 'status': 301, 'headers': allow_header },
1540+ { 'path': '/', 'status': 200, 'headers': allow_header },
1541+ { 'path': '/repos', 'status': 301, 'headers': allow_header },
1542+ { 'path': '/repos/', 'status': 200, 'headers': allow_header },
1543+ { 'path': '/repos/A', 'status': 301, 'headers': allow_header },
1544+ { 'path': '/repos/A/', 'status': 200, 'headers': allow_header },
1545+ { 'path': '/repos/A/D', 'status': 301, 'headers': allow_header },
1546+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H, 'headers': allow_header },
1547+ { 'path': '/repos/A/D/gamma', 'status': 200, 'headers': allow_header },
1548+ # these 3 tests return 403 instead of 401 becasue the config allows
1549+ # the anon user with the ALLOW header without any auth and the old hook
1550+ # system has no way of knowing it should return 401 since authentication is
1551+ # configured and can change the behavior. It could decide to return 401 just on
1552+ # the basis of authentication being configured but then that leaks info in other
1553+ # cases so it's better for this case to be "broken".
1554+ { 'path': '/repos/A/D/H', 'status': 403, 'headers': allow_header },
1555+ { 'path': '/repos/A/D/H/', 'status': 403, 'headers': allow_header },
1556+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'headers': allow_header },
1557+ # auth is configured and user1 is allowed access repo including H
1558+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1559+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1560+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1561+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1562+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1563+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1564+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1565+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1566+ 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1567+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1568+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1569+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1570+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1571+ # try with the wrong password for user1
1572+ { 'path': '', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1573+ { 'path': '/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1574+ { 'path': '/repos', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1575+ { 'path': '/repos/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1576+ { 'path': '/repos/A', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1577+ { 'path': '/repos/A/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1578+ { 'path': '/repos/A/D', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1579+ { 'path': '/repos/A/D/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1580+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1581+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1582+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1583+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1584+ # auth is configured and user2 is not allowed access to H
1585+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1586+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1587+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1588+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1589+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1590+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1591+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1592+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1593+ 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1594+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1595+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1596+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1597+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1598+ # try with the wrong password for user2
1599+ { 'path': '', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1600+ { 'path': '/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1601+ { 'path': '/repos', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1602+ { 'path': '/repos/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1603+ { 'path': '/repos/A', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1604+ { 'path': '/repos/A/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1605+ { 'path': '/repos/A/D', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1606+ { 'path': '/repos/A/D/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1607+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1608+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1609+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1610+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1611+
1612+ )
1613+
1614+ verify_gets(test_area_url, sallrany_tests)
1615+
1616+# See comments on authn_sallrany test for some background on the interaction
1617+# of Satisfy Any and the newer Require blocks.
1618+@SkipUnless(svntest.main.is_httpd_authz_provider_enabled)
1619+def authn_sallrall(sbox):
1620+ "test satisfy all require all config"
1621+ sbox.build(read_only = True, create_wc = False)
1622+
1623+ test_area_url = sbox.repo_url.replace('/svn-test-work/local_tmp/repos',
1624+ '/authz-test-work/sallrall')
1625+
1626+ write_authz_file(sbox)
1627+
1628+ allow_header = { 'ALLOW': '1' }
1629+
1630+ sallrall_tests = (
1631+ #anon access isn't allowed without ALLOW header
1632+ { 'path': '', 'status': 403, },
1633+ { 'path': '/', 'status': 403, },
1634+ { 'path': '/repos', 'status': 403, },
1635+ { 'path': '/repos/', 'status': 403, },
1636+ { 'path': '/repos/A', 'status': 403, },
1637+ { 'path': '/repos/A/', 'status': 403, },
1638+ { 'path': '/repos/A/D', 'status': 403, },
1639+ { 'path': '/repos/A/D/', 'status': 403, },
1640+ { 'path': '/repos/A/D/gamma', 'status': 403, },
1641+ { 'path': '/repos/A/D/H', 'status': 403, },
1642+ { 'path': '/repos/A/D/H/', 'status': 403, },
1643+ { 'path': '/repos/A/D/H/chi', 'status': 403, },
1644+ # auth is configured but no access is allowed without the ALLOW header
1645+ { 'path': '', 'status': 403, 'user': user1, 'pw': user1_pass},
1646+ { 'path': '/', 'status': 403, 'user': user1, 'pw': user1_pass},
1647+ { 'path': '/repos', 'status': 403, 'user': user1, 'pw': user1_pass},
1648+ { 'path': '/repos/', 'status': 403, 'user': user1, 'pw': user1_pass},
1649+ { 'path': '/repos/A', 'status': 403, 'user': user1, 'pw': user1_pass},
1650+ { 'path': '/repos/A/', 'status': 403, 'user': user1, 'pw': user1_pass},
1651+ { 'path': '/repos/A/D', 'status': 403, 'user': user1, 'pw': user1_pass},
1652+ { 'path': '/repos/A/D/', 'status': 403, 'user': user1, 'pw': user1_pass},
1653+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user1, 'pw': user1_pass},
1654+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user1, 'pw': user1_pass},
1655+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user1, 'pw': user1_pass},
1656+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user1, 'pw': user1_pass},
1657+ # try with the wrong password for user1
1658+ { 'path': '', 'status': 403, 'user': user1, 'pw': user1_badpass},
1659+ { 'path': '/', 'status': 403, 'user': user1, 'pw': user1_badpass},
1660+ { 'path': '/repos', 'status': 403, 'user': user1, 'pw': user1_badpass},
1661+ { 'path': '/repos/', 'status': 403, 'user': user1, 'pw': user1_badpass},
1662+ { 'path': '/repos/A', 'status': 403, 'user': user1, 'pw': user1_badpass},
1663+ { 'path': '/repos/A/', 'status': 403, 'user': user1, 'pw': user1_badpass},
1664+ { 'path': '/repos/A/D', 'status': 403, 'user': user1, 'pw': user1_badpass},
1665+ { 'path': '/repos/A/D/', 'status': 403, 'user': user1, 'pw': user1_badpass},
1666+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user1, 'pw': user1_badpass},
1667+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user1, 'pw': user1_badpass},
1668+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user1, 'pw': user1_badpass},
1669+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user1, 'pw': user1_badpass},
1670+ # auth is configured but no access is allowed without the ALLOW header
1671+ { 'path': '', 'status': 403, 'user': user2, 'pw': user2_pass},
1672+ { 'path': '/', 'status': 403, 'user': user2, 'pw': user2_pass},
1673+ { 'path': '/repos', 'status': 403, 'user': user2, 'pw': user2_pass},
1674+ { 'path': '/repos/', 'status': 403, 'user': user2, 'pw': user2_pass},
1675+ { 'path': '/repos/A', 'status': 403, 'user': user2, 'pw': user2_pass},
1676+ { 'path': '/repos/A/', 'status': 403, 'user': user2, 'pw': user2_pass},
1677+ { 'path': '/repos/A/D', 'status': 403, 'user': user2, 'pw': user2_pass},
1678+ { 'path': '/repos/A/D/', 'status': 403, 'user': user2, 'pw': user2_pass},
1679+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user2, 'pw': user2_pass},
1680+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass},
1681+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass},
1682+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass},
1683+ # try with the wrong password for user2
1684+ { 'path': '', 'status': 403, 'user': user2, 'pw': user2_badpass},
1685+ { 'path': '/', 'status': 403, 'user': user2, 'pw': user2_badpass},
1686+ { 'path': '/repos', 'status': 403, 'user': user2, 'pw': user2_badpass},
1687+ { 'path': '/repos/', 'status': 403, 'user': user2, 'pw': user2_badpass},
1688+ { 'path': '/repos/A', 'status': 403, 'user': user2, 'pw': user2_badpass},
1689+ { 'path': '/repos/A/', 'status': 403, 'user': user2, 'pw': user2_badpass},
1690+ { 'path': '/repos/A/D', 'status': 403, 'user': user2, 'pw': user2_badpass},
1691+ { 'path': '/repos/A/D/', 'status': 403, 'user': user2, 'pw': user2_badpass},
1692+ { 'path': '/repos/A/D/gamma', 'status': 403, 'user': user2, 'pw': user2_badpass},
1693+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_badpass},
1694+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_badpass},
1695+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_badpass},
1696+ # anon is not allowed even with ALLOW header
1697+ { 'path': '', 'status': 401, 'headers': allow_header },
1698+ { 'path': '/', 'status': 401, 'headers': allow_header },
1699+ { 'path': '/repos', 'status': 401, 'headers': allow_header },
1700+ { 'path': '/repos/', 'status': 401, 'headers': allow_header },
1701+ { 'path': '/repos/A', 'status': 401, 'headers': allow_header },
1702+ { 'path': '/repos/A/', 'status': 401, 'headers': allow_header },
1703+ { 'path': '/repos/A/D', 'status': 401, 'headers': allow_header },
1704+ { 'path': '/repos/A/D/', 'status': 401, 'headers': allow_header },
1705+ { 'path': '/repos/A/D/gamma', 'status': 401, 'headers': allow_header },
1706+ { 'path': '/repos/A/D/H', 'status': 401, 'headers': allow_header },
1707+ { 'path': '/repos/A/D/H/', 'status': 401, 'headers': allow_header },
1708+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'headers': allow_header },
1709+ # auth is configured and user1 is allowed access repo including H
1710+ { 'path': '', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1711+ { 'path': '/', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1712+ { 'path': '/repos', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1713+ { 'path': '/repos/', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1714+ { 'path': '/repos/A', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1715+ { 'path': '/repos/A/', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1716+ { 'path': '/repos/A/D', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1717+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_H,
1718+ 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1719+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1720+ { 'path': '/repos/A/D/H', 'status': 301, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1721+ { 'path': '/repos/A/D/H/', 'status': 200, 'body': ls_of_H, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1722+ { 'path': '/repos/A/D/H/chi', 'status': 200, 'user': user1, 'pw': user1_pass, 'headers': allow_header },
1723+ # try with the wrong password for user1
1724+ { 'path': '', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1725+ { 'path': '/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1726+ { 'path': '/repos', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1727+ { 'path': '/repos/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1728+ { 'path': '/repos/A', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1729+ { 'path': '/repos/A/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1730+ { 'path': '/repos/A/D', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1731+ { 'path': '/repos/A/D/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1732+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1733+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1734+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1735+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user1, 'pw': user1_badpass, 'headers': allow_header },
1736+ # auth is configured and user2 is not allowed access to H
1737+ { 'path': '', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1738+ { 'path': '/', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1739+ { 'path': '/repos', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1740+ { 'path': '/repos/', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1741+ { 'path': '/repos/A', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1742+ { 'path': '/repos/A/', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1743+ { 'path': '/repos/A/D', 'status': 301, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1744+ { 'path': '/repos/A/D/', 'status': 200, 'body': ls_of_D_no_H,
1745+ 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1746+ { 'path': '/repos/A/D/gamma', 'status': 200, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1747+ { 'path': '/repos/A/D/H', 'status': 403, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1748+ { 'path': '/repos/A/D/H/', 'status': 403, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1749+ { 'path': '/repos/A/D/H/chi', 'status': 403, 'user': user2, 'pw': user2_pass, 'headers': allow_header },
1750+ # try with the wrong password for user2
1751+ { 'path': '', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1752+ { 'path': '/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1753+ { 'path': '/repos', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1754+ { 'path': '/repos/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1755+ { 'path': '/repos/A', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1756+ { 'path': '/repos/A/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1757+ { 'path': '/repos/A/D', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1758+ { 'path': '/repos/A/D/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1759+ { 'path': '/repos/A/D/gamma', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1760+ { 'path': '/repos/A/D/H', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1761+ { 'path': '/repos/A/D/H/', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1762+ { 'path': '/repos/A/D/H/chi', 'status': 401, 'user': user2, 'pw': user2_badpass, 'headers': allow_header },
1763+
1764+ )
1765+
1766+ verify_gets(test_area_url, sallrall_tests)
1767+
1768+
1769+########################################################################
1770+# Run the tests
1771+
1772+
1773+# list all tests here, starting with None:
1774+test_list = [ None,
1775+ anon,
1776+ mixed,
1777+ mixed_noauthwhenanon,
1778+ authn,
1779+ authn_anonoff,
1780+ authn_lcuser,
1781+ authn_group,
1782+ authn_sallrany,
1783+ authn_sallrall,
1784+ ]
1785+serial_only = True
1786+
1787+if __name__ == '__main__':
1788+ svntest.main.run_tests(test_list)
1789+ # NOTREACHED
1790+
1791+
1792+### End of file.
1793
1794Property changes on: subversion/tests/cmdline/mod_authz_svn_tests.py
1795___________________________________________________________________
1796Added: svn:eol-style
1797## -0,0 +1 ##
1798+native
1799\ No newline at end of property
1800Index: subversion/tests/cmdline/svntest/main.py
1801===================================================================
1802--- a/subversion/tests/cmdline/svntest/main.py (revision 1691883)
1803+++ b/subversion/tests/cmdline/svntest/main.py (working copy)
1804@@ -1378,6 +1378,30 @@ def is_plaintext_password_storage_disabled():
1805 return False
1806 return True
1807
1808+
1809+# https://issues.apache.org/bugzilla/show_bug.cgi?id=56480
1810+# https://issues.apache.org/bugzilla/show_bug.cgi?id=55397
1811+__mod_dav_url_quoting_broken_versions = frozenset([
1812+ '2.2.27',
1813+ '2.2.26',
1814+ '2.2.25',
1815+ '2.4.9',
1816+ '2.4.8',
1817+ '2.4.7',
1818+ '2.4.6',
1819+ '2.4.5',
1820+])
1821+def is_mod_dav_url_quoting_broken():
1822+ if is_ra_type_dav():
1823+ return (options.httpd_version in __mod_dav_url_quoting_broken_versions)
1824+ return None
1825+
1826+def is_httpd_authz_provider_enabled():
1827+ if is_ra_type_dav():
1828+ v = options.httpd_version.split('.')
1829+ return (v[0] == '2' and int(v[1]) >= 3) or int(v[0]) > 2
1830+ return None
1831+
1832 ######################################################################
1833
1834
1835@@ -1435,6 +1459,8 @@ class TestSpawningThread(threading.Thread):
1836 args.append('--ssl-cert=' + options.ssl_cert)
1837 if options.http_proxy:
1838 args.append('--http-proxy=' + options.http_proxy)
1839+ if options.httpd_version:
1840+ args.append('--httpd-version=' + options.httpd_version)
1841
1842 result, stdout_lines, stderr_lines = spawn_process(command, 0, False, None,
1843 *args)
1844@@ -1600,6 +1626,12 @@ class TestRunner:
1845 sandbox.cleanup_test_paths()
1846 return exit_code
1847
1848+def is_httpd_authz_provider_enabled():
1849+ if is_ra_type_dav():
1850+ v = options.httpd_version.split('.')
1851+ return (v[0] == '2' and int(v[1]) >= 3) or int(v[0]) > 2
1852+ return None
1853+
1854 ######################################################################
1855 # Main testing functions
1856
1857@@ -1780,6 +1812,8 @@ def _create_parser():
1858 help='Path to SSL server certificate.')
1859 parser.add_option('--http-proxy', action='store',
1860 help='Use the HTTP Proxy at hostname:port.')
1861+ parser.add_option('--httpd-version', action='store',
1862+ help='Assume HTTPD is this version.')
1863 parser.add_option('--tools-bin', action='store', dest='tools_bin',
1864 help='Use the svn tools installed in this path')
1865
1866Index: win-tests.py
1867===================================================================
1868--- a/win-tests.py (revision 1691883)
1869+++ b/win-tests.py (working copy)
1870@@ -481,6 +481,7 @@ class Httpd:
1871 self.httpd_config = os.path.join(self.root, 'httpd.conf')
1872 self.httpd_users = os.path.join(self.root, 'users')
1873 self.httpd_mime_types = os.path.join(self.root, 'mime.types')
1874+ self.httpd_groups = os.path.join(self.root, 'groups')
1875 self.abs_builddir = abs_builddir
1876 self.abs_objdir = abs_objdir
1877 self.service_name = 'svn-test-httpd-' + str(httpd_port)
1878@@ -494,6 +495,7 @@ class Httpd:
1879 create_target_dir(self.root_dir)
1880
1881 self._create_users_file()
1882+ self._create_groups_file()
1883 self._create_mime_types_file()
1884 self._create_dontdothat_file()
1885
1886@@ -540,6 +542,8 @@ class Httpd:
1887 if self.httpd_ver >= 2.2:
1888 fp.write(self._sys_module('auth_basic_module', 'mod_auth_basic.so'))
1889 fp.write(self._sys_module('authn_file_module', 'mod_authn_file.so'))
1890+ fp.write(self._sys_module('authz_groupfile_module', 'mod_authz_groupfile.so'))
1891+ fp.write(self._sys_module('authz_host_module', 'mod_authz_host.so'))
1892 else:
1893 fp.write(self._sys_module('auth_module', 'mod_auth.so'))
1894 fp.write(self._sys_module('alias_module', 'mod_alias.so'))
1895@@ -562,6 +566,7 @@ class Httpd:
1896 # Define two locations for repositories
1897 fp.write(self._svn_repo('repositories'))
1898 fp.write(self._svn_repo('local_tmp'))
1899+ fp.write(self._svn_authz_repo())
1900
1901 # And two redirects for the redirect tests
1902 fp.write('RedirectMatch permanent ^/svn-test-work/repositories/'
1903@@ -592,7 +597,18 @@ class Httpd:
1904 'jrandom', 'rayjandom'])
1905 os.spawnv(os.P_WAIT, htpasswd, ['htpasswd.exe', '-bp', self.httpd_users,
1906 'jconstant', 'rayjandom'])
1907+ os.spawnv(os.P_WAIT, htpasswd, ['htpasswd.exe', '-bp', self.httpd_users,
1908+ 'JRANDOM', 'rayjandom'])
1909+ os.spawnv(os.P_WAIT, htpasswd, ['htpasswd.exe', '-bp', self.httpd_users,
1910+ 'JCONSTANT', 'rayjandom'])
1911
1912+ def _create_groups_file(self):
1913+ "Create groups for mod_authz_svn tests"
1914+ fp = open(self.httpd_groups, 'w')
1915+ fp.write('random: jrandom\n')
1916+ fp.write('constant: jconstant\n')
1917+ fp.close()
1918+
1919 def _create_mime_types_file(self):
1920 "Create empty mime.types file"
1921 fp = open(self.httpd_mime_types, 'w')
1922@@ -652,6 +668,153 @@ class Httpd:
1923 ' DontDoThatConfigFile ' + self._quote(self.dontdothat_file) + '\n' \
1924 '</Location>\n'
1925
1926+ def _svn_authz_repo(self):
1927+ local_tmp = os.path.join(self.abs_builddir,
1928+ CMDLINE_TEST_SCRIPT_NATIVE_PATH,
1929+ 'svn-test-work', 'local_tmp')
1930+ return \
1931+ '<Location /authz-test-work/anon>' + '\n' \
1932+ ' DAV svn' + '\n' \
1933+ ' SVNParentPath ' + local_tmp + '\n' \
1934+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
1935+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
1936+ ' SVNListParentPath On' + '\n' \
1937+ ' <IfModule mod_authz_core.c>' + '\n' \
1938+ ' Require all granted' + '\n' \
1939+ ' </IfModule>' + '\n' \
1940+ ' <IfModule !mod_authz_core.c>' + '\n' \
1941+ ' Allow from all' + '\n' \
1942+ ' </IfModule>' + '\n' \
1943+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
1944+ '</Location>' + '\n' \
1945+ '<Location /authz-test-work/mixed>' + '\n' \
1946+ ' DAV svn' + '\n' \
1947+ ' SVNParentPath ' + local_tmp + '\n' \
1948+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
1949+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
1950+ ' SVNListParentPath On' + '\n' \
1951+ ' AuthType Basic' + '\n' \
1952+ ' AuthName "Subversion Repository"' + '\n' \
1953+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
1954+ ' Require valid-user' + '\n' \
1955+ ' Satisfy Any' + '\n' \
1956+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
1957+ '</Location>' + '\n' \
1958+ '<Location /authz-test-work/mixed-noauthwhenanon>' + '\n' \
1959+ ' DAV svn' + '\n' \
1960+ ' SVNParentPath ' + local_tmp + '\n' \
1961+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
1962+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
1963+ ' SVNListParentPath On' + '\n' \
1964+ ' AuthType Basic' + '\n' \
1965+ ' AuthName "Subversion Repository"' + '\n' \
1966+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
1967+ ' Require valid-user' + '\n' \
1968+ ' AuthzSVNNoAuthWhenAnonymousAllowed On' + '\n' \
1969+ ' SVNPathAuthz On' + '\n' \
1970+ '</Location>' + '\n' \
1971+ '<Location /authz-test-work/authn>' + '\n' \
1972+ ' DAV svn' + '\n' \
1973+ ' SVNParentPath ' + local_tmp + '\n' \
1974+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
1975+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
1976+ ' SVNListParentPath On' + '\n' \
1977+ ' AuthType Basic' + '\n' \
1978+ ' AuthName "Subversion Repository"' + '\n' \
1979+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
1980+ ' Require valid-user' + '\n' \
1981+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
1982+ '</Location>' + '\n' \
1983+ '<Location /authz-test-work/authn-anonoff>' + '\n' \
1984+ ' DAV svn' + '\n' \
1985+ ' SVNParentPath ' + local_tmp + '\n' \
1986+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
1987+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
1988+ ' SVNListParentPath On' + '\n' \
1989+ ' AuthType Basic' + '\n' \
1990+ ' AuthName "Subversion Repository"' + '\n' \
1991+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
1992+ ' Require valid-user' + '\n' \
1993+ ' AuthzSVNAnonymous Off' + '\n' \
1994+ ' SVNPathAuthz On' + '\n' \
1995+ '</Location>' + '\n' \
1996+ '<Location /authz-test-work/authn-lcuser>' + '\n' \
1997+ ' DAV svn' + '\n' \
1998+ ' SVNParentPath ' + local_tmp + '\n' \
1999+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
2000+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
2001+ ' SVNListParentPath On' + '\n' \
2002+ ' AuthType Basic' + '\n' \
2003+ ' AuthName "Subversion Repository"' + '\n' \
2004+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
2005+ ' Require valid-user' + '\n' \
2006+ ' AuthzForceUsernameCase Lower' + '\n' \
2007+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
2008+ '</Location>' + '\n' \
2009+ '<Location /authz-test-work/authn-lcuser>' + '\n' \
2010+ ' DAV svn' + '\n' \
2011+ ' SVNParentPath ' + local_tmp + '\n' \
2012+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
2013+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
2014+ ' SVNListParentPath On' + '\n' \
2015+ ' AuthType Basic' + '\n' \
2016+ ' AuthName "Subversion Repository"' + '\n' \
2017+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
2018+ ' Require valid-user' + '\n' \
2019+ ' AuthzForceUsernameCase Lower' + '\n' \
2020+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
2021+ '</Location>' + '\n' \
2022+ '<Location /authz-test-work/authn-group>' + '\n' \
2023+ ' DAV svn' + '\n' \
2024+ ' SVNParentPath ' + local_tmp + '\n' \
2025+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
2026+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
2027+ ' SVNListParentPath On' + '\n' \
2028+ ' AuthType Basic' + '\n' \
2029+ ' AuthName "Subversion Repository"' + '\n' \
2030+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
2031+ ' AuthGroupFile ' + self._quote(self.httpd_groups) + '\n' \
2032+ ' Require group random' + '\n' \
2033+ ' AuthzSVNAuthoritative Off' + '\n' \
2034+ ' SVNPathAuthz On' + '\n' \
2035+ '</Location>' + '\n' \
2036+ '<IfModule mod_authz_core.c>' + '\n' \
2037+ '<Location /authz-test-work/sallrany>' + '\n' \
2038+ ' DAV svn' + '\n' \
2039+ ' SVNParentPath ' + local_tmp + '\n' \
2040+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
2041+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
2042+ ' SVNListParentPath On' + '\n' \
2043+ ' AuthType Basic' + '\n' \
2044+ ' AuthName "Subversion Repository"' + '\n' \
2045+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
2046+ ' AuthzSendForbiddenOnFailure On' + '\n' \
2047+ ' Satisfy All' + '\n' \
2048+ ' <RequireAny>' + '\n' \
2049+ ' Require valid-user' + '\n' \
2050+ ' Require expr req(\'ALLOW\') == \'1\'' + '\n' \
2051+ ' </RequireAny>' + '\n' \
2052+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
2053+ '</Location>' + '\n' \
2054+ '<Location /authz-test-work/sallrall>'+ '\n' \
2055+ ' DAV svn' + '\n' \
2056+ ' SVNParentPath ' + local_tmp + '\n' \
2057+ ' AuthzSVNAccessFile ' + self._quote(self.authz_file) + '\n' \
2058+ ' SVNAdvertiseV2Protocol ' + self.httpv2_option + '\n' \
2059+ ' SVNListParentPath On' + '\n' \
2060+ ' AuthType Basic' + '\n' \
2061+ ' AuthName "Subversion Repository"' + '\n' \
2062+ ' AuthUserFile ' + self._quote(self.httpd_users) + '\n' \
2063+ ' AuthzSendForbiddenOnFailure On' + '\n' \
2064+ ' Satisfy All' + '\n' \
2065+ ' <RequireAll>' + '\n' \
2066+ ' Require valid-user' + '\n' \
2067+ ' Require expr req(\'ALLOW\') == \'1\'' + '\n' \
2068+ ' </RequireAll>' + '\n' \
2069+ ' SVNPathAuthz ' + self.path_authz_option + '\n' \
2070+ '</Location>' + '\n' \
2071+ '</IfModule>' + '\n' \
2072+
2073 def start(self):
2074 if self.service:
2075 self._start_service()
2076@@ -786,6 +949,10 @@ if not test_javahl:
2077 log_file = os.path.join(abs_builddir, log)
2078 fail_log_file = os.path.join(abs_builddir, faillog)
2079
2080+ if run_httpd:
2081+ httpd_version = "%.1f" % daemon.httpd_ver
2082+ else:
2083+ httpd_version = None
2084 th = run_tests.TestHarness(abs_srcdir, abs_builddir,
2085 log_file,
2086 fail_log_file,
2087@@ -795,6 +962,7 @@ if not test_javahl:
2088 fsfs_sharding, fsfs_packing,
2089 list_tests, svn_bin, mode_filter,
2090 milestone_filter,
2091+ httpd_version=httpd_version,
2092 set_log_level=log_level, ssl_cert=ssl_cert)
2093 old_cwd = os.getcwd()
2094 try:
diff --git a/meta/recipes-devtools/subversion/subversion_1.8.13.bb b/meta/recipes-devtools/subversion/subversion_1.8.13.bb
index 9c9bdb192b..9505247be5 100644
--- a/meta/recipes-devtools/subversion/subversion_1.8.13.bb
+++ b/meta/recipes-devtools/subversion/subversion_1.8.13.bb
@@ -14,6 +14,7 @@ SRC_URI = "${APACHE_MIRROR}/${BPN}/${BPN}-${PV}.tar.bz2 \
14 file://libtool2.patch \ 14 file://libtool2.patch \
15 file://disable_macos.patch \ 15 file://disable_macos.patch \
16 file://serf.m4-Regex-modified-to-allow-D-in-paths.patch \ 16 file://serf.m4-Regex-modified-to-allow-D-in-paths.patch \
17 file://subversion-CVE-2015-3184.patch \
17" 18"
18SRC_URI[md5sum] = "4413417b529d7bdf82f74e50df02e88b" 19SRC_URI[md5sum] = "4413417b529d7bdf82f74e50df02e88b"
19SRC_URI[sha256sum] = "1099cc68840753b48aedb3a27ebd1e2afbcc84ddb871412e5d500e843d607579" 20SRC_URI[sha256sum] = "1099cc68840753b48aedb3a27ebd1e2afbcc84ddb871412e5d500e843d607579"
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2024-11-16 20:50:12 +0000