As suggested by Marc Slemko, document the double reverse

effect of Allow/Deny.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@100878 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/mod/mod_authz_host.html.en b/docs/manual/mod/mod_authz_host.html.en
index d032a35ef242fce7cc7717d4de0ac2223ce50688..da9ac2e7ce381283aa9b1c825901d7f2b2ee2c03 100644 (file)
--- a/docs/manual/mod/mod_authz_host.html.en
+++ b/docs/manual/mod/mod_authz_host.html.en
@@ -106,11 +106,15 @@ server</td></tr>
       </code></p></div>
       <p>Hosts whose names match, or end in, this string are allowed
       access. Only complete components are matched, so the above
-      example will match <code>foo.apache.org</code> but it will
-      not match <code>fooapache.org</code>. This configuration will
-      cause the server to perform a reverse DNS lookup on the
-      client IP address, regardless of the setting of the <code class="directive"><a href="../mod/core.html#hostnamelookups">HostnameLookups</a></code>
-      directive.</p></dd>
+      example will match <code>foo.apache.org</code> but it will not
+      match <code>fooapache.org</code>. This configuration will cause
+      Apache to perform a double reverse DNS lookup on the client IP
+      address, regardless of the setting of the <code class="directive"><a href="../mod/core.html#hostnamelookups">HostnameLookups</a></code> directive.  It will do
+      a reverse DNS lookup on the IP address to find the associated
+      hostname, and then do a forward lookup on the hostname to assure
+      that it matches the original IP address.  Only if the forward
+      and reverse DNS are consistent and the hostname matches will
+      access be allowed.</p></dd>
 
       <dt>A full IP address</dt>
 

diff --git a/docs/manual/mod/mod_authz_host.xml b/docs/manual/mod/mod_authz_host.xml
index 51069dde4d33e21c602d5d005d3f2a3056d94641..9979548647341ed8e75e690b9784f42dea8a5c5f 100644 (file)
--- a/docs/manual/mod/mod_authz_host.xml
+++ b/docs/manual/mod/mod_authz_host.xml
@@ -82,12 +82,16 @@ server</description>
       </example>
       <p>Hosts whose names match, or end in, this string are allowed
       access. Only complete components are matched, so the above
-      example will match <code>foo.apache.org</code> but it will
-      not match <code>fooapache.org</code>. This configuration will
-      cause the server to perform a reverse DNS lookup on the
-      client IP address, regardless of the setting of the <directive
-      module="core">HostnameLookups</directive>
-      directive.</p></dd>
+      example will match <code>foo.apache.org</code> but it will not
+      match <code>fooapache.org</code>. This configuration will cause
+      Apache to perform a double reverse DNS lookup on the client IP
+      address, regardless of the setting of the <directive
+      module="core">HostnameLookups</directive> directive.  It will do
+      a reverse DNS lookup on the IP address to find the associated
+      hostname, and then do a forward lookup on the hostname to assure
+      that it matches the original IP address.  Only if the forward
+      and reverse DNS are consistent and the hostname matches will
+      access be allowed.</p></dd>
 
       <dt>A full IP address</dt>