Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Apache Directives without argument fail to parse #3

Open
rickschippers opened this issue Aug 29, 2019 · 4 comments
Open

Apache Directives without argument fail to parse #3

rickschippers opened this issue Aug 29, 2019 · 4 comments

Comments

@rickschippers
Copy link

I have a few vhosts that use the SSLRequireSSL directive (https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#sslrequiressl).

This directive is used as is. There are no parameters, no on/off. It's just a line inside a vhosts that states: SSLRequireSSL. Nothing else.

When you have a config file that has this it fails to parse. You get "Apache config format error!".
This is caused by the regex in ConfigType/Apache.php which expects a whitespace and then some more things which isn't there.

            if (preg_match('/^\s*(\w+)(?:\s+(.*?)|)\s*$/', $configLine, $configMatches)) { // Property
                if (!isset($configMatches[2])) {
                    throw new \UnexpectedValueException("Apache config format error!");
                }
                if ($level === 0) {
                    $block[$configMatches[1]] = $configMatches[2];
                    $result = $this->append($block, $result);
                    $block = array();
                } else {
                    $blockIn[$configMatches[1]] = $configMatches[2];
                    $blockChild = $this->append($blockIn, $blockChild);
                    $blockIn = array();
                }
            }
@rickschippers
Copy link
Author

rickschippers commented Aug 30, 2019

An example vhost i'm trying to parse (generated by plesk). The SSLRequireSSL line is breaking the parsing at the moment.

<IfModule mod_ssl.c>

	<VirtualHost 1.2.3.4:7081 >
		ServerName "some-website.com:443"
		ServerAlias "www.some-website.com"
		ServerAlias "ipv4.some-website.com"
		UseCanonicalName Off

		DocumentRoot "/var/www/vhosts/some-website.com/web"
		CustomLog /var/www/vhosts/system/some-website.com/logs/access_ssl_log plesklog
		ErrorLog "/var/www/vhosts/system/some-website.com/logs/error_log"

		<IfModule mod_suexec.c>
			SuexecUserGroup "some-website" "psacln"
		</IfModule>

		<IfModule mod_userdir.c>

			UserDir "/var/www/vhosts/some-website.com/web_users/*"
		</IfModule>

		<IfModule mod_sysenv.c>
			SetSysEnv PP_VHOST_ID "e36346a7-aa12-bb34-cc56-57c723542b20"
		</IfModule>

		SSLEngine on
		SSLVerifyClient none
		SSLCertificateFile /opt/psa/var/certificates/scf8yoYiT
		SSLCACertificateFile /opt/psa/var/certificates/scfCj3iX4

		<IfModule mod_fcgid.c>
			FcgidInitialEnv PP_CUSTOM_PHP_INI /var/www/vhosts/system/some-website.com/etc/php.ini
			FcgidInitialEnv PP_CUSTOM_PHP_CGI_INDEX ondrejsury72
			FcgidMaxRequestLen 134217728
			FcgidIOTimeout 120
		</IfModule>

		TimeOut 120
		<Directory /var/www/vhosts/some-website.com/web>

			<IfModule mod_fcgid.c>
				<Files ~ (\.fcgi$)>
					SetHandler fcgid-script
					Options +ExecCGI
				</Files>
			</IfModule>
			<IfModule mod_fcgid.c>
				<Files ~ (\.php$)>
					SetHandler fcgid-script
					FCGIWrapper /var/www/cgi-bin/cgi_wrapper/cgi_wrapper .php
					Options +ExecCGI
				</Files>
			</IfModule>

			SSLRequireSSL

			Options -Includes -ExecCGI

		</Directory>

		<Directory "/var/www/vhosts/system/some-website.com/statistics">
			AuthType Basic
			AuthName "Domain statistics"
			AuthUserFile "/var/www/vhosts/system/some-website.com/pd/d..httpdocs@plesk-stat"
			require valid-user
		</Directory>

		Alias /error_docs /var/www/vhosts/some-website.com/error_docs
		ErrorDocument 400 /error_docs/bad_request.html
		ErrorDocument 401 /error_docs/unauthorized.html
		ErrorDocument 403 /error_docs/forbidden.html
		ErrorDocument 404 /error_docs/not_found.html
		ErrorDocument 500 /error_docs/internal_server_error.html
		ErrorDocument 405 /error_docs/method_not_allowed.html
		ErrorDocument 406 /error_docs/not_acceptable.html
		ErrorDocument 407 /error_docs/proxy_authentication_required.html
		ErrorDocument 412 /error_docs/precondition_failed.html
		ErrorDocument 414 /error_docs/request_uri_too_long.html
		ErrorDocument 415 /error_docs/unsupported_media_type.html
		ErrorDocument 501 /error_docs/not_implemented.html
		ErrorDocument 502 /error_docs/bad_gateway.html
		ErrorDocument 503 /error_docs/maintenance.html

		DirectoryIndex "index.html" "index.cgi" "index.pl" "index.php" "index.xhtml" "index.htm" "index.shtml"

		Include "/var/www/vhosts/system/some-website.com/conf/vhost_ssl.conf"

		<Directory /var/www/vhosts/some-website.com>
			AllowOverride AuthConfig FileInfo Indexes Limit Options=Indexes,SymLinksIfOwnerMatch,MultiViews,FollowSymLinks,ExecCGI,Includes,IncludesNOEXEC
		</Directory>

		#extension letsencrypt begin
		Alias /.well-known/acme-challenge "/var/www/vhosts/default/htdocs/.well-known/acme-challenge"

		<Location /.well-known/acme-challenge/>
			# Require all granted
			Order Deny,Allow
			Allow from all
			Satisfy any
		</Location>

		<LocationMatch "^/.well-known/acme-challenge/(.*/|)\.">
			# Require all denied
			Order Allow,Deny
			Deny from all
		</LocationMatch>
		#extension letsencrypt end
	</VirtualHost>
</IfModule>

@nikoutel
Copy link
Owner

I have fixed this bug, but found another one when I tested it on your example vhost.
I'll let you know.

@nikoutel
Copy link
Owner

Apache Directives without argument are very rare.
I have found only 2! So I have hard-coded them as an exception.
Due to their nature, I thing the value true is suitable.

Changing the regex would require further changes down the road, such the asArrayFlat() function, which I would like to avoid.

Let me know if everything is OK now.

@rickschippers
Copy link
Author

rickschippers commented Aug 30, 2019

This works for me. It parses fine like this.

But wouldn't it be safer to change to the regex to * instead of + and then fill the $configMatches[2] with true if it's not existing. That way you'll catch any directive like this and it won't break stuff later on in the parsing.

Offcourse there aren't many of these directives in the core apache. But apache is modular, so it can be extended with any number of (3rd party) modules, that could add config directives.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants