<div>Hi Daniel,</div><div> </div><div>Thanks for the suggestions. Looks like it doesn't require too much additional work to follow this, and we can still keep the required amount of changes at minimum. I also thought an RFC is to be posted in this topic.</div>
<div> </div><div> </div><div>Best regards,</div><div> </div><div>Tamas</div><div> </div><div> <br><br></div><div class="gmail_quote">2013/2/13 Daniel Morissette <span dir="ltr"><<a href="mailto:dmorissette@mapgears.com" target="_blank">dmorissette@mapgears.com</a>></span><br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid">Thank you Steve for suggesting the support of subnet masks (a.b.c.d/mask), I was going to suggest the same thing.<br>
<br>
I also would like to suggest supporting both a list of addresses from a file, or the ability to provide the values directly in the mapfile. In cases where there are only a couple of IPs to list, being able to specify them directly in the mapfile would be much more user-friendly.<br>
<br>
e.g.<br>
<br>
space-delimited list of addresses:<br>
<br>
"ows_allowed_ip_list" "123.45.67.89 11.22.33.44"<br>
<br>
or ref to a file:<br>
<br>
"ows_allowed_ip_list" "file:/path/to/list_of_ips.<u></u>txt"<br>
<br>
<br>
I think that long term we'll want more powerful access control mechanisms, we have discussed this several times here, but that is a much bigger issue to tackle and I think the proposed mechanism can easily be deprecated without important side-effects the day that we would have something more powerful in place.<br>
<br>
And finally, even if that is a simple and straightforward addition, I think that a short RFC to document it would be nice and I'd encourage you to produce one. RFCs are often the only reference for some features until they make it to the docs... there are even some features from a few releases ago for which the RFC is still the only/best docs available (unfortunately).<br>
<br>
<br>
Daniel<div class="im"><br>
<br>
<br>
On 13-02-13 10:18 AM, Tamas Szekeres wrote:<br>
</div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;padding-left:1ex;border-left-color:rgb(204,204,204);border-left-width:1px;border-left-style:solid"><div class="im">
Hi Steve,<br>
<br>
Thanks for the comments, using CIDR notation<br></div>
<<a href="http://en.wikipedia.org/wiki/CIDR_notation" target="_blank">http://en.wikipedia.org/wiki/<u></u>CIDR_notation</a>> to define ranges would be<div class="im"><br>
reasonable. This would allow to define subnets in a single row. I think<br>
it would work with both ipv4 and ipv6 addresses.<br>
<br>
Best regards,<br>
<br>
Tamas<br>
<br>
<br>
<br>
2013/2/13 Stephen Woodbridge <<a href="mailto:woodbri@swoodbridge.com" target="_blank">woodbri@swoodbridge.com</a><br></div>
<mailto:<a href="mailto:woodbri@swoodbridge.com" target="_blank">woodbri@swoodbridge.<u></u>com</a>>>:<div class="im"><br>
> On 2/13/2013 8:45 AM, Tamas Szekeres wrote:<br>
>><br>
>> Hi Devs,<br>
>><br>
>> I got a requirement from Faunalia (<a href="http://www.faunalia.it" target="_blank">http://www.faunalia.it</a>) to<br>
>> establish option to Enable/disable OWS layers by IP list.<br>
>> We need to add two new parameters to the WEB section of the mapfile,<br>
>> and/or in the METADATA section of every single layer:<br>
>><br>
>> 1. "ows_allowed_ip_list"<br>
>> 2. "ows_denied_ip_list"<br>
>><br>
>> Both should point to a file with a list of IP addresses.<br>
><br>
><br>
> If you are pointing to a file then these should be<br>
><br>
> ows_allowed_ip_file<br>
> ows_denied_ip_file<br>
><br>
> to avoid confusion. Using "list" implies that a item target should be<br>
a list<br>
> of ip addrs and not a file.<br>
><br>
> These should not allow parameter substitution as that would be a simple<br>
> defeat of the mechanism.<br>
><br>
> Do you plan to support address ranges like:<br>
><br>
> 192.168.1.1-192.168.1.10<br></div>
> <a href="http://192.168.1.0/24" target="_blank">192.168.1.0/24</a> <<a href="http://192.168.1.0/24" target="_blank">http://192.168.1.0/24</a>><div class="im"><br>
><br>
> Otherwise looks fine.<br>
><br>
> -Steve W<br>
><br>
>> The aim is to let the admin to define list of users, identified<br>
>> through their IPs to<br>
>> allow or deny access to one or more specific WMS or WFS layers.<br>
>><br>
>> I've prepared an implementation to this requirement which appears to<br>
>> be a fairly simple addition to the code:<br>
>><br>
>><br>
<a href="https://github.com/szekerest/mapserver/commit/4b7c203a1782cd56d01c34e1079a184c04e51207" target="_blank">https://github.com/szekerest/<u></u>mapserver/commit/<u></u>4b7c203a1782cd56d01c34e1079a18<u></u>4c04e51207</a><br>
>><br>
>> In my approach if both the allowed list and the denied list contains<br>
>> the current endpoint IP then the denied list will take precedence.<br>
>> If allowed_ip_list or ows_denied_ip_list is not specified or the<br>
>> specified files are not readable then the current behaviour will<br>
>> continue to work.<br>
>><br>
>> Issue has also been added for this addition:<br>
>> <a href="https://github.com/mapserver/mapserver/issues/4588" target="_blank">https://github.com/mapserver/<u></u>mapserver/issues/4588</a><br>
>><br>
>><br>
>> Let me know about your opinion whether this change is reasonable.<br>
>> Would that require an RFC to be added?<br>
>><br>
>> Deadline of this addition is close, so I'd prefer to include this as<br>
>> soon as possible.<br>
>><br>
>><br>
>> Best regards,<br>
>><br>
>> Tamas<br>
>> ______________________________<u></u>_________________<br>
>> mapserver-dev mailing list<br></div>
>> <a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.osgeo.org</a> <mailto:<a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.<u></u>osgeo.org</a>><div class="im">
<br>
>> <a href="http://lists.osgeo.org/mailman/listinfo/mapserver-dev" target="_blank">http://lists.osgeo.org/<u></u>mailman/listinfo/mapserver-dev</a><br>
>><br>
><br>
> ______________________________<u></u>_________________<br>
> mapserver-dev mailing list<br></div>
> <a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.osgeo.org</a> <mailto:<a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.<u></u>osgeo.org</a>><div class="im">
<br>
> <a href="http://lists.osgeo.org/mailman/listinfo/mapserver-dev" target="_blank">http://lists.osgeo.org/<u></u>mailman/listinfo/mapserver-dev</a><br>
<br>
<br>
<br>
______________________________<u></u>_________________<br>
mapserver-dev mailing list<br>
<a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.osgeo.org</a><br>
<a href="http://lists.osgeo.org/mailman/listinfo/mapserver-dev" target="_blank">http://lists.osgeo.org/<u></u>mailman/listinfo/mapserver-dev</a><br>
<br>
</div></blockquote><span class="HOEnZb"><font color="#888888">
<br>
<br>
-- <br>
Daniel Morissette<br>
<a href="http://www.mapgears.com/" target="_blank">http://www.mapgears.com/</a><br>
Provider of Professional MapServer Support since 2000</font></span><div class="HOEnZb"><div class="h5"><br>
<br>
______________________________<u></u>_________________<br>
mapserver-dev mailing list<br>
<a href="mailto:mapserver-dev@lists.osgeo.org" target="_blank">mapserver-dev@lists.osgeo.org</a><br>
<a href="http://lists.osgeo.org/mailman/listinfo/mapserver-dev" target="_blank">http://lists.osgeo.org/<u></u>mailman/listinfo/mapserver-dev</a><br>
</div></div></blockquote></div><br>