Attachment #32755 for bug #57949

View | Details | Raw Unified | Return to bug 57949
Collapse All | Expand All




<tr><td><code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em></td> <td>string</td>    <td>PEM-encoded certificates in client certificate chain</td></tr>
<tr><td><code>SSL_CLIENT_CERT_RFC4523_CEA</code></td>   <td>string</td>    <td>Serial number and issuer of the certificate. The format matches that of the CertificateExactAssertion in RFC4523</td></tr>
<tr><td><code>SSL_CLIENT_VERIFY</code></td>             <td>string</td>    <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS</code> or <code>FAILED:</code><em>reason</em></td></tr>
<tr><td><code>SSL_CLIENT_EXT_KEYUSAGE_</code><em>purpose</em></td> <td>string</td>  <td><code>true</code> if certificate has the corresponding <em>purpose</em> otherwise <code>false</code>.</td></tr>
<tr><td><code>SSL_SERVER_M_VERSION</code></td>          <td>string</td>    <td>The version of the server certificate</td></tr>
<tr><td><code>SSL_SERVER_M_SERIAL</code></td>           <td>string</td>    <td>The serial of the server certificate</td></tr>
<tr><td><code>SSL_SERVER_S_DN</code></td>               <td>string</td>    <td>Subject DN in server's certificate</td></tr>

<tr><td><code>SSL_SERVER_A_SIG</code></td>              <td>string</td>    <td>Algorithm used for the signature of server's certificate</td></tr>
<tr><td><code>SSL_SERVER_A_KEY</code></td>              <td>string</td>    <td>Algorithm used for the public key of server's certificate</td></tr>
<tr><td><code>SSL_SERVER_CERT</code></td>               <td>string</td>    <td>PEM-encoded server certificate</td></tr>
<tr><td><code>SSL_SERVER_EXT_KEYUSAGE_</code><em>purpose</em></td> <td>string</td>  <td><code>true</code> if certificate has the corresponding <em>purpose</em> otherwise <code>false</code>.</td></tr>
<tr><td><code>SSL_SRP_USER</code></td>                  <td>string</td>    <td>SRP username</td></tr>
<tr><td><code>SSL_SRP_USERINFO</code></td>              <td>string</td>    <td>SRP user info</td></tr>
<tr><td><code>SSL_TLS_SNI</code></td>                   <td>string</td>    <td>Contents of the SNI TLS extension (if supplied with ClientHello)</td></tr>

first (or only) attribute of any DN is added only under a non-suffixed
name; i.e. no <code>_0</code> suffixed entries are added.</p>

<p><em>purpose</em> specifies an extended key usage value either as a 
shortname or as an oid. Shortname are case insensitive. Since dots aren't 
permit on variable name if <em>purpose</em> define an oid all <code>'.'</code> should 
be replace with <code>'_'</code>. Theses are all valid values : 
<code>SSL_CLIENT_EXT_KEYUSAGE_clientAuth</code>, 
<code>SSL_CLIENT_EXT_KEYUSAGE_CLIENTAUTH</code>, 
<code>SSL_CLIENT_EXT_KEYUSAGE_1_3_6_1_5_5_7_3_2</code>. RFC5280 stipulate 
that <em>extended key usage extension</em> must be consistent with 
<em>key usage extension</em> but no check of such are done here.
</p>

<p>The format of the <em>*_DN</em> variables has changed in Apache HTTPD
2.3.11. See the <code>LegacyDNStringFormat</code> option for
<directive module="mod_ssl">SSLOptions</directive> for details.</p>




static char *ssl_var_lookup_ssl_cert(apr_pool_t *p, request_rec *r, X509 *xs, char *var);
static char *ssl_var_lookup_ssl_cert_dn(apr_pool_t *p, X509_NAME *xsname, char *var);
static char *ssl_var_lookup_ssl_cert_san(apr_pool_t *p, X509 *xs, char *var);
static char *ssl_var_lookup_ssl_cert_ext_keyusage(apr_pool_t *p, X509 *xs, char *var);
static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm);
static char *ssl_var_lookup_ssl_cert_remain(apr_pool_t *p, ASN1_TIME *tm);
static char *ssl_var_lookup_ssl_cert_serial(apr_pool_t *p, X509 *xs);

    else if (strcEQ(var, "CERT")) {
        result = ssl_var_lookup_ssl_cert_PEM(p, xs);
    }
    else if (strlen(var) > 13 && strcEQn(var, "EXT_KEYUSAGE_", 13)) {
        result = ssl_var_lookup_ssl_cert_ext_keyusage(p, xs, var+13);
    }

    if (resdup)
        result = apr_pstrdup(p, result);

       return NULL;
}

static char * ssl_var_lookup_ssl_cert_ext_keyusage(apr_pool_t *p, X509 *xs, char *var)
{
    char *oid = apr_pcalloc(p, 128);
    EXTENDED_KEY_USAGE *extusage;
    
    if( (extusage = X509_get_ext_d2i(xs, NID_ext_key_usage, NULL, NULL)) ){
        for (int i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
            ASN1_OBJECT *obj = sk_ASN1_OBJECT_value(extusage, i);
            int nid = OBJ_obj2nid(obj);

            if(apr_strnatcasecmp(var, OBJ_nid2sn(nid)) == 0)
                return "true";

            //convert _ into . for oid
            for(int j = 0; var[j]; j++)
                if(var[j] == '_')
                    var[j] = '.';

            OBJ_obj2txt(oid, 128, obj, 1);
            if(apr_strnatcasecmp(var, oid) == 0)
                return "true";
        }

        sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
    }

    return "false";
}

static char *ssl_var_lookup_ssl_cert_valid(apr_pool_t *p, ASN1_TIME *tm)
{
    char *result;

Return to bug 57949

Lines 88-94 compatibility variables.</p> Link Here

(-)a/docs/manual/mod/mod_ssl.xml (-13 lines)
88	<tr><td><code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em></td> <td>string</td> <td>PEM-encoded certificates in client certificate chain</td></tr>	88	<tr><td><code>SSL_CLIENT_CERT_CHAIN_</code><em>n</em></td> <td>string</td> <td>PEM-encoded certificates in client certificate chain</td></tr>
89	<tr><td><code>SSL_CLIENT_CERT_RFC4523_CEA</code></td> <td>string</td> <td>Serial number and issuer of the certificate. The format matches that of the CertificateExactAssertion in RFC4523</td></tr>	89	<tr><td><code>SSL_CLIENT_CERT_RFC4523_CEA</code></td> <td>string</td> <td>Serial number and issuer of the certificate. The format matches that of the CertificateExactAssertion in RFC4523</td></tr>
90	<tr><td><code>SSL_CLIENT_VERIFY</code></td> <td>string</td> <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS</code> or <code>FAILED:</code><em>reason</em></td></tr>	90	<tr><td><code>SSL_CLIENT_VERIFY</code></td> <td>string</td> <td><code>NONE</code>, <code>SUCCESS</code>, <code>GENEROUS</code> or <code>FAILED:</code><em>reason</em></td></tr>
91	<tr><td><code>SSL_CLIENT_EXT_KEYUSAGE_</code><em>purpose</em></td> <td>string</td> <td><code>true</code> if certificate has the corresponding <em>purpose</em> otherwise <code>false</code>.</td></tr>
92	<tr><td><code>SSL_SERVER_M_VERSION</code></td> <td>string</td> <td>The version of the server certificate</td></tr>	91	<tr><td><code>SSL_SERVER_M_VERSION</code></td> <td>string</td> <td>The version of the server certificate</td></tr>
93	<tr><td><code>SSL_SERVER_M_SERIAL</code></td> <td>string</td> <td>The serial of the server certificate</td></tr>	92	<tr><td><code>SSL_SERVER_M_SERIAL</code></td> <td>string</td> <td>The serial of the server certificate</td></tr>
94	<tr><td><code>SSL_SERVER_S_DN</code></td> <td>string</td> <td>Subject DN in server's certificate</td></tr>	93	<tr><td><code>SSL_SERVER_S_DN</code></td> <td>string</td> <td>Subject DN in server's certificate</td></tr>
Lines 102-108 compatibility variables.</p> Link Here
102	<tr><td><code>SSL_SERVER_A_SIG</code></td> <td>string</td> <td>Algorithm used for the signature of server's certificate</td></tr>	101	<tr><td><code>SSL_SERVER_A_SIG</code></td> <td>string</td> <td>Algorithm used for the signature of server's certificate</td></tr>
103	<tr><td><code>SSL_SERVER_A_KEY</code></td> <td>string</td> <td>Algorithm used for the public key of server's certificate</td></tr>	102	<tr><td><code>SSL_SERVER_A_KEY</code></td> <td>string</td> <td>Algorithm used for the public key of server's certificate</td></tr>
104	<tr><td><code>SSL_SERVER_CERT</code></td> <td>string</td> <td>PEM-encoded server certificate</td></tr>	103	<tr><td><code>SSL_SERVER_CERT</code></td> <td>string</td> <td>PEM-encoded server certificate</td></tr>
105	<tr><td><code>SSL_SERVER_EXT_KEYUSAGE_</code><em>purpose</em></td> <td>string</td> <td><code>true</code> if certificate has the corresponding <em>purpose</em> otherwise <code>false</code>.</td></tr>
106	<tr><td><code>SSL_SRP_USER</code></td> <td>string</td> <td>SRP username</td></tr>	104	<tr><td><code>SSL_SRP_USER</code></td> <td>string</td> <td>SRP username</td></tr>
107	<tr><td><code>SSL_SRP_USERINFO</code></td> <td>string</td> <td>SRP user info</td></tr>	105	<tr><td><code>SSL_SRP_USERINFO</code></td> <td>string</td> <td>SRP user info</td></tr>
108	<tr><td><code>SSL_TLS_SNI</code></td> <td>string</td> <td>Contents of the SNI TLS extension (if supplied with ClientHello)</td></tr>	106	<tr><td><code>SSL_TLS_SNI</code></td> <td>string</td> <td>Contents of the SNI TLS extension (if supplied with ClientHello)</td></tr>
Lines 125-141 the <directive module="mod_ssl">SSLOptions</directive> directive, the Link Here
125	first (or only) attribute of any DN is added only under a non-suffixed	123	first (or only) attribute of any DN is added only under a non-suffixed
126	name; i.e. no <code>_0</code> suffixed entries are added.</p>	124	name; i.e. no <code>_0</code> suffixed entries are added.</p>
127		125
128	<p><em>purpose</em> specifies an extended key usage value either as a
129	shortname or as an oid. Shortname are case insensitive. Since dots aren't
130	permit on variable name if <em>purpose</em> define an oid all <code>'.'</code> should
131	be replace with <code>'_'</code>. Theses are all valid values :
132	<code>SSL_CLIENT_EXT_KEYUSAGE_clientAuth</code>,
133	<code>SSL_CLIENT_EXT_KEYUSAGE_CLIENTAUTH</code>,
134	<code>SSL_CLIENT_EXT_KEYUSAGE_1_3_6_1_5_5_7_3_2</code>. RFC5280 stipulate
135	that <em>extended key usage extension</em> must be consistent with
136	<em>key usage extension</em> but no check of such are done here.
137	</p>
138
139	<p>The format of the <em>*_DN</em> variables has changed in Apache HTTPD	126	<p>The format of the <em>*_DN</em> variables has changed in Apache HTTPD
140	2.3.11. See the <code>LegacyDNStringFormat</code> option for	127	2.3.11. See the <code>LegacyDNStringFormat</code> option for
141	<directive module="mod_ssl">SSLOptions</directive> for details.</p>	128	<directive module="mod_ssl">SSLOptions</directive> for details.</p>

Lines 43-49 static char ssl_var_lookup_ssl(apr_pool_t p, conn_rec c, request_rec r, char Link Here

(-)a/modules/ssl/ssl_engine_vars.c (-33 lines)
43	static char ssl_var_lookup_ssl_cert(apr_pool_t p, request_rec r, X509 xs, char *var);	43	static char ssl_var_lookup_ssl_cert(apr_pool_t p, request_rec r, X509 xs, char *var);
44	static char ssl_var_lookup_ssl_cert_dn(apr_pool_t p, X509_NAME xsname, char var);	44	static char ssl_var_lookup_ssl_cert_dn(apr_pool_t p, X509_NAME xsname, char var);
45	static char ssl_var_lookup_ssl_cert_san(apr_pool_t p, X509 xs, char var);	45	static char ssl_var_lookup_ssl_cert_san(apr_pool_t p, X509 xs, char var);
46	static char ssl_var_lookup_ssl_cert_ext_keyusage(apr_pool_t p, X509 xs, char var);
47	static char ssl_var_lookup_ssl_cert_valid(apr_pool_t p, ASN1_TIME *tm);	46	static char ssl_var_lookup_ssl_cert_valid(apr_pool_t p, ASN1_TIME *tm);
48	static char ssl_var_lookup_ssl_cert_remain(apr_pool_t p, ASN1_TIME *tm);	47	static char ssl_var_lookup_ssl_cert_remain(apr_pool_t p, ASN1_TIME *tm);
49	static char ssl_var_lookup_ssl_cert_serial(apr_pool_t p, X509 *xs);	48	static char ssl_var_lookup_ssl_cert_serial(apr_pool_t p, X509 *xs);
Lines 519-527 static char ssl_var_lookup_ssl_cert(apr_pool_t p, request_rec r, X509 xs, Link Here
519	else if (strcEQ(var, "CERT")) {	518	else if (strcEQ(var, "CERT")) {
520	result = ssl_var_lookup_ssl_cert_PEM(p, xs);	519	result = ssl_var_lookup_ssl_cert_PEM(p, xs);
521	}	520	}
522	else if (strlen(var) > 13 && strcEQn(var, "EXT_KEYUSAGE_", 13)) {
523	result = ssl_var_lookup_ssl_cert_ext_keyusage(p, xs, var+13);
524	}
525		521
526	if (resdup)	522	if (resdup)
527	result = apr_pstrdup(p, result);	523	result = apr_pstrdup(p, result);
Lines 623-657 static char ssl_var_lookup_ssl_cert_san(apr_pool_t p, X509 xs, char var) Link Here
623	return NULL;	619	return NULL;
624	}	620	}
625		621
626	static char * ssl_var_lookup_ssl_cert_ext_keyusage(apr_pool_t p, X509 xs, char *var)
627	{
628	char *oid = apr_pcalloc(p, 128);
629	EXTENDED_KEY_USAGE *extusage;
630
631	if( (extusage = X509_get_ext_d2i(xs, NID_ext_key_usage, NULL, NULL)) ){
632	for (int i = 0; i < sk_ASN1_OBJECT_num(extusage); i++) {
633	ASN1_OBJECT *obj = sk_ASN1_OBJECT_value(extusage, i);
634	int nid = OBJ_obj2nid(obj);
635
636	if(apr_strnatcasecmp(var, OBJ_nid2sn(nid)) == 0)
637	return "true";
638
639	//convert _ into . for oid
640	for(int j = 0; var[j]; j++)
641	if(var[j] == '_')
642	var[j] = '.';
643
644	OBJ_obj2txt(oid, 128, obj, 1);
645	if(apr_strnatcasecmp(var, oid) == 0)
646	return "true";
647	}
648
649	sk_ASN1_OBJECT_pop_free(extusage, ASN1_OBJECT_free);
650	}
651
652	return "false";
653	}
654
655	static char ssl_var_lookup_ssl_cert_valid(apr_pool_t p, ASN1_TIME *tm)	622	static char ssl_var_lookup_ssl_cert_valid(apr_pool_t p, ASN1_TIME *tm)
656	{	623	{
657	char *result;	624	char *result;