[PATCH] AllowConnect 'none' option, bz69879

Rich Bowen <[email protected]> Mon, 16 Mar 2026 08:47:07 +0100
Newsgroups gmane.comp.apache.devel
Message-ID <[email protected]> 
The attached patch adds a ’none’ option for AllowConnect, as per https://bz.apache.org/bugzilla/show_bug.cgi?id=69879

Would appreciate reviews. Thanks.


— 
Rich Bowen
[email protected]
mod_proxy_connect.patch (application/octet-stream, 2.4 KB) 
Index: modules/proxy/mod_proxy_connect.c
===================================================================
--- modules/proxy/mod_proxy_connect.c	(revision 1932327)
+++ modules/proxy/mod_proxy_connect.c	(working copy)
@@ -48,6 +48,7 @@
 
 typedef struct {
     apr_array_header_t *allowed_connect_ports;
+    int allow_none;
 } connect_conf;
 
 typedef struct {
@@ -71,6 +72,7 @@
     c->allowed_connect_ports = apr_array_append(p,
                                                 base->allowed_connect_ports,
                                                 overrides->allowed_connect_ports);
+    c->allow_none = overrides->allow_none || base->allow_none;
 
     return c;
 }
@@ -90,8 +92,13 @@
     char *endptr;
     const char *p = arg;
 
+    if (!ap_cstr_casecmp(arg, "none")) {
+        conf->allow_none = 1;
+        return NULL;
+    }
+
     if (!apr_isdigit(arg[0]))
-        return "AllowCONNECT: port numbers must be numeric";
+        return "AllowCONNECT: port numbers must be numeric, or 'None'";
 
     first = strtol(p, &endptr, 10);
     if (*endptr == '-') {
@@ -119,6 +126,10 @@
     int i;
     port_range *list = (port_range *) conf->allowed_connect_ports->elts;
 
+    if (conf->allow_none) {
+        return 0;
+    }
+
     if (apr_is_empty_array(conf->allowed_connect_ports)) {
         return port == APR_URI_HTTPS_DEFAULT_PORT
                || port == APR_URI_SNEWS_DEFAULT_PORT;
Index: docs/manual/mod/mod_proxy_connect.xml
===================================================================
--- docs/manual/mod/mod_proxy_connect.xml	(revision 1932327)
+++ docs/manual/mod/mod_proxy_connect.xml	(working copy)
@@ -83,7 +83,7 @@
 <description>Ports that are allowed to <code>CONNECT</code> through the
 proxy</description>
 <syntax>AllowCONNECT <var>port</var>[-<var>port</var>]
-[<var>port</var>[-<var>port</var>]] ...</syntax>
+[<var>port</var>[-<var>port</var>]] ... | None</syntax>
 <default>AllowCONNECT 443 563</default>
 <contextlist><context>server config</context><context>virtual host</context>
 </contextlist>
@@ -100,6 +100,9 @@
     default snews port (<code>563</code>) are enabled. Use the
     <directive>AllowCONNECT</directive> directive to override this default and
     allow connections to the listed ports only.</p>
+
+    <p>Set the value to <code>None</code> to disallow
+    <code>CONNECT</code> requests to all ports, including the defaults.</p>
 </usage>
 </directivesynopsis>