/* Copyright 2001-2005 The Apache Software Foundation or its licensors, as

* applicable.

*

* Licensed under the Apache License, Version 2.0 (the "License");

* you may not use this file except in compliance with the License.

* You may obtain a copy of the License at

*

* http://www.apache.org/licenses/LICENSE-2.0

*

* Unless required by applicable law or agreed to in writing, software

* distributed under the License is distributed on an "AS IS" BASIS,

* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

* See the License for the specific language governing permissions and

* limitations under the License.

*/

/* _ _

* _ __ ___ ___ __| | ___ ___| | mod_ssl

* | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL

* | | | | | | (_) | (_| | \__ \__ \ |

* |_| |_| |_|\___/ \__,_|___|___/___/_|

* |_____|

* ssl_engine_kernel.c

* The SSL engine kernel

*/

/* ``It took me fifteen years to discover

I had no talent for programming, but

I couldn't give it up because by that

time I was too famous.''

-- Unknown */

#include "mod_ssl.h"

/*

* Post Read Request Handler

*/

int ssl_hook_ReadReq(request_rec *r)

{

SSLConnRec *sslconn = myConnConfig(r->connection);

SSL *ssl;

if (!sslconn) {

return DECLINED;

}

if (sslconn->non_ssl_request) {

const char *errmsg;

char *thisurl;

char *thisport = "";

int port = ap_get_server_port(r);

if (!ap_is_default_port(port, r)) {

thisport = apr_psprintf(r->pool, ":%u", port);

}

thisurl = ap_escape_html(r->pool,

apr_psprintf(r->pool, "https://%s%s/",

ap_get_server_name(r),

thisport));

errmsg = apr_psprintf(r->pool,

"Reason: You're speaking plain HTTP "

"to an SSL-enabled server port.<br />\n"

"Instead use the HTTPS scheme to access "

"this URL, please.<br />\n"

"<blockquote>Hint: "

"<a href=\"%s\"><b>%s</b></a></blockquote>",

thisurl, thisurl);

apr_table_setn(r->notes, "error-notes", errmsg);

/* Now that we have caught this error, forget it. we are done

* with using SSL on this request.

*/

sslconn->non_ssl_request = 0;

return HTTP_BAD_REQUEST;

}

/*

* Get the SSL connection structure and perform the

* delayed interlinking from SSL back to request_rec

*/

if ((ssl = sslconn->ssl)) {

SSL_set_app_data2(ssl, r);

}

return DECLINED;

}

/*

* Move SetEnvIf information from request_rec to conn_rec/BUFF

* to allow the close connection handler to use them.

*/

static void ssl_configure_env(request_rec *r, SSLConnRec *sslconn)

{

int i;

const apr_array_header_t *arr = apr_table_elts(r->subprocess_env);

const apr_table_entry_t *elts = (const apr_table_entry_t *)arr->elts;

sslconn->shutdown_type = SSL_SHUTDOWN_TYPE_STANDARD;

for (i = 0; i < arr->nelts; i++) {

const char *key = elts[i].key;

switch (*key) {

case 's':

/* being case-sensitive here.

* and not checking for the -shutdown since these are the only

* SetEnvIf "flags" we support

*/

if (!strncmp(key+1, "sl-", 3)) {

key += 4;

if (!strncmp(key, "unclean", 7)) {

sslconn->shutdown_type = SSL_SHUTDOWN_TYPE_UNCLEAN;

}

else if (!strncmp(key, "accurate", 8)) {

sslconn->shutdown_type = SSL_SHUTDOWN_TYPE_ACCURATE;

}

return; /* should only ever be one ssl-*-shutdown */

}

break;

}

}

}

/*

* URL Translation Handler

*/

int ssl_hook_Translate(request_rec *r)

{

SSLConnRec *sslconn = myConnConfig(r->connection);

if (!(sslconn && sslconn->ssl)) {

return DECLINED;

}

/*

* Log information about incoming HTTPS requests

*/

if (r->server->loglevel >= APLOG_INFO && ap_is_initial_req(r)) {

ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,

"%s HTTPS request received for child %ld (server %s)",

(r->connection->keepalives <= 0 ?

"Initial (No.1)" :

apr_psprintf(r->pool, "Subsequent (No.%d)",

r->connection->keepalives+1)),

r->connection->id,

ssl_util_vhostid(r->pool, r->server));

}

/* SetEnvIf ssl-*-shutdown flags can only be per-server,

* so they won't change across keepalive requests

*/

if (sslconn->shutdown_type == SSL_SHUTDOWN_TYPE_UNSET) {

ssl_configure_env(r, sslconn);

}

return DECLINED;

}

/*

* Access Handler

*/

int ssl_hook_Access(request_rec *r)

{

SSLDirConfigRec *dc = myDirConfig(r);

SSLSrvConfigRec *sc = mySrvConfig(r->server);

SSLConnRec *sslconn = myConnConfig(r->connection);

SSL *ssl = sslconn ? sslconn->ssl : NULL;

SSL_CTX *ctx = NULL;

apr_array_header_t *requires;

ssl_require_t *ssl_requires;

char *cp;

int ok, i;

BOOL renegotiate = FALSE, renegotiate_quick = FALSE;

X509 *cert;

X509 *peercert;

X509_STORE *cert_store = NULL;

X509_STORE_CTX cert_store_ctx;

STACK_OF(SSL_CIPHER) *cipher_list_old = NULL, *cipher_list = NULL;

SSL_CIPHER *cipher = NULL;

int depth, verify_old, verify, n;

if (ssl) {

ctx = SSL_get_SSL_CTX(ssl);

}

/*

* Support for SSLRequireSSL directive

*/

if (dc->bSSLRequired && !ssl) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"access to %s failed, reason: %s",

r->filename, "SSL connection required");

/* remember forbidden access for strict require option */

apr_table_setn(r->notes, "ssl-access-forbidden", "1");

return HTTP_FORBIDDEN;

}

/*

* Check to see if SSL protocol is on

*/

if (!(sc->enabled || ssl)) {

return DECLINED;

}

/*

* Support for per-directory reconfigured SSL connection parameters.

*

* This is implemented by forcing an SSL renegotiation with the

* reconfigured parameter suite. But Apache's internal API processing

* makes our life very hard here, because when internal sub-requests occur

* we nevertheless should avoid multiple unnecessary SSL handshakes (they

* require extra network I/O and especially time to perform).

*

* But the optimization for filtering out the unnecessary handshakes isn't

* obvious and trivial. Especially because while Apache is in its

* sub-request processing the client could force additional handshakes,

* too. And these take place perhaps without our notice. So the only

* possibility is to explicitly _ask_ OpenSSL whether the renegotiation

* has to be performed or not. It has to performed when some parameters

* which were previously known (by us) are not those we've now

* reconfigured (as known by OpenSSL) or (in optimized way) at least when

* the reconfigured parameter suite is stronger (more restrictions) than

* the currently active one.

*/

/*

* Override of SSLCipherSuite

*

* We provide two options here:

*

* o The paranoid and default approach where we force a renegotiation when

* the cipher suite changed in _any_ way (which is straight-forward but

* often forces renegotiations too often and is perhaps not what the

* user actually wanted).

*

* o The optimized and still secure way where we force a renegotiation

* only if the currently active cipher is no longer contained in the

* reconfigured/new cipher suite. Any other changes are not important

* because it's the servers choice to select a cipher from the ones the

* client supports. So as long as the current cipher is still in the new

* cipher suite we're happy. Because we can assume we would have

* selected it again even when other (better) ciphers exists now in the

* new cipher suite. This approach is fine because the user explicitly

* has to enable this via ``SSLOptions +OptRenegotiate''. So we do no

* implicit optimizations.

*/

if (dc->szCipherSuite) {

/* remember old state */

if (dc->nOptions & SSL_OPT_OPTRENEGOTIATE) {

cipher = SSL_get_current_cipher(ssl);

}

else {

cipher_list_old = (STACK_OF(SSL_CIPHER) *)SSL_get_ciphers(ssl);

if (cipher_list_old) {

cipher_list_old = sk_SSL_CIPHER_dup(cipher_list_old);

}

}

/* configure new state */

if (!modssl_set_cipher_list(ssl, dc->szCipherSuite)) {

ap_log_error(APLOG_MARK, APLOG_WARNING, 0,

r->server,

"Unable to reconfigure (per-directory) "

"permitted SSL ciphers");

ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, r->server);

if (cipher_list_old) {

sk_SSL_CIPHER_free(cipher_list_old);

}

return HTTP_FORBIDDEN;

}

/* determine whether a renegotiation has to be forced */

cipher_list = (STACK_OF(SSL_CIPHER) *)SSL_get_ciphers(ssl);

if (dc->nOptions & SSL_OPT_OPTRENEGOTIATE) {

/* optimized way */

if ((!cipher && cipher_list) ||

(cipher && !cipher_list))

{

renegotiate = TRUE;

}

else if (cipher && cipher_list &&

(sk_SSL_CIPHER_find(cipher_list, cipher) < 0))

{

renegotiate = TRUE;

}

}

else {

/* paranoid way */

if ((!cipher_list_old && cipher_list) ||

(cipher_list_old && !cipher_list))

{

renegotiate = TRUE;

}

else if (cipher_list_old && cipher_list) {

for (n = 0;

!renegotiate && (n < sk_SSL_CIPHER_num(cipher_list));

n++)

{

SSL_CIPHER *value = sk_SSL_CIPHER_value(cipher_list, n);

if (sk_SSL_CIPHER_find(cipher_list_old, value) < 0) {

renegotiate = TRUE;

}

}

for (n = 0;

!renegotiate && (n < sk_SSL_CIPHER_num(cipher_list_old));

n++)

{

SSL_CIPHER *value = sk_SSL_CIPHER_value(cipher_list_old, n);

if (sk_SSL_CIPHER_find(cipher_list, value) < 0) {

renegotiate = TRUE;

}

}

}

}

/* cleanup */

if (cipher_list_old) {

sk_SSL_CIPHER_free(cipher_list_old);

}

/* tracing */

if (renegotiate) {

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,

"Reconfigured cipher suite will force renegotiation");

}

}

/*

* override of SSLVerifyDepth

*

* The depth checks are handled by us manually inside the verify callback

* function and not by OpenSSL internally (and our function is aware of

* both the per-server and per-directory contexts). So we cannot ask

* OpenSSL about the currently verify depth. Instead we remember it in our

* ap_ctx attached to the SSL* of OpenSSL. We've to force the

* renegotiation if the reconfigured/new verify depth is less than the

* currently active/remembered verify depth (because this means more

* restriction on the certificate chain).

*/

if (dc->nVerifyDepth != UNSET) {

/* XXX: doesnt look like sslconn->verify_depth is actually used */

if (!(n = sslconn->verify_depth)) {

sslconn->verify_depth = n = sc->server->auth.verify_depth;

}

/* determine whether a renegotiation has to be forced */

if (dc->nVerifyDepth < n) {

renegotiate = TRUE;

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,

"Reduced client verification depth will force "

"renegotiation");

}

}

/*

* override of SSLVerifyClient

*

* We force a renegotiation if the reconfigured/new verify type is

* stronger than the currently active verify type.

*

* The order is: none << optional_no_ca << optional << require

*

* Additionally the following optimization is possible here: When the

* currently active verify type is "none" but a client certificate is

* already known/present, it's enough to manually force a client

* verification but at least skip the I/O-intensive renegotation

* handshake.

*/

if (dc->nVerifyClient != SSL_CVERIFY_UNSET) {

/* remember old state */

verify_old = SSL_get_verify_mode(ssl);

/* configure new state */

verify = SSL_VERIFY_NONE;

if (dc->nVerifyClient == SSL_CVERIFY_REQUIRE) {

verify |= SSL_VERIFY_PEER_STRICT;

}

if ((dc->nVerifyClient == SSL_CVERIFY_OPTIONAL) ||

(dc->nVerifyClient == SSL_CVERIFY_OPTIONAL_NO_CA))

{

verify |= SSL_VERIFY_PEER;

}

modssl_set_verify(ssl, verify, ssl_callback_SSLVerify);

SSL_set_verify_result(ssl, X509_V_OK);

/* determine whether we've to force a renegotiation */

if (!renegotiate && verify != verify_old) {

if (((verify_old == SSL_VERIFY_NONE) &&

(verify != SSL_VERIFY_NONE)) ||

(!(verify_old & SSL_VERIFY_PEER) &&

(verify & SSL_VERIFY_PEER)) ||

(!(verify_old & SSL_VERIFY_PEER_STRICT) &&

(verify & SSL_VERIFY_PEER_STRICT)))

{

renegotiate = TRUE;

/* optimization */

if ((dc->nOptions & SSL_OPT_OPTRENEGOTIATE) &&

(verify_old == SSL_VERIFY_NONE) &&

((peercert = SSL_get_peer_certificate(ssl)) != NULL))

{

renegotiate_quick = TRUE;

X509_free(peercert);

}

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,

r->server,

"Changed client verification type will force "

"%srenegotiation",

renegotiate_quick ? "quick " : "");

}

}

}

/*

* override SSLCACertificateFile & SSLCACertificatePath

* This is only enabled if the SSL_set_cert_store() function

* is available in the ssl library. the 1.x based mod_ssl

* used SSL_CTX_set_cert_store which is not thread safe.

*/

#ifdef HAVE_SSL_SET_CERT_STORE

/*

* check if per-dir and per-server config field are not the same.

* if f is defined in per-dir and not defined in per-server

* or f is defined in both but not the equal ...

*/

#define MODSSL_CFG_NE(f) \

(dc->f && (!sc->f || (sc->f && strNE(dc->f, sc->f))))

#define MODSSL_CFG_CA(f) \

(dc->f ? dc->f : sc->f)

if (MODSSL_CFG_NE(szCACertificateFile) ||

MODSSL_CFG_NE(szCACertificatePath))

{

STACK_OF(X509_NAME) *ca_list;

const char *ca_file = MODSSL_CFG_CA(szCACertificateFile);

const char *ca_path = MODSSL_CFG_CA(szCACertificatePath);

cert_store = X509_STORE_new();

if (!X509_STORE_load_locations(cert_store, ca_file, ca_path)) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Unable to reconfigure verify locations "

"for client authentication");

ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, r->server);

X509_STORE_free(cert_store);

return HTTP_FORBIDDEN;

}

/* SSL_free will free cert_store */

SSL_set_cert_store(ssl, cert_store);

if (!(ca_list = ssl_init_FindCAList(r->server, r->pool,

ca_file, ca_path)))

{

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Unable to determine list of available "

"CA certificates for client authentication");

return HTTP_FORBIDDEN;

}

SSL_set_client_CA_list(ssl, ca_list);

renegotiate = TRUE;

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,

"Changed client verification locations will force "

"renegotiation");

}

#endif /* HAVE_SSL_SET_CERT_STORE */

/*

* SSL renegotiations in conjunction with HTTP

* requests using the POST method are not supported.

*

* Background:

*

* 1. When the client sends a HTTP/HTTPS request, Apache's core code

* reads only the request line ("METHOD /path HTTP/x.y") and the

* attached MIME headers ("Foo: bar") up to the terminating line ("CR

* LF"). An attached request body (for instance the data of a POST

* method) is _NOT_ read. Instead it is read by mod_cgi's content

* handler and directly passed to the CGI script.

*

* 2. mod_ssl supports per-directory re-configuration of SSL parameters.

* This is implemented by performing an SSL renegotiation of the

* re-configured parameters after the request is read, but before the

* response is sent. In more detail: the renegotiation happens after the

* request line and MIME headers were read, but _before_ the attached

* request body is read. The reason simply is that in the HTTP protocol

* usually there is no acknowledgment step between the headers and the

* body (there is the 100-continue feature and the chunking facility

* only), so Apache has no API hook for this step.

*

* 3. the problem now occurs when the client sends a POST request for

* URL /foo via HTTPS the server and the server has SSL parameters

* re-configured on a per-URL basis for /foo. Then mod_ssl has to

* perform an SSL renegotiation after the request was read and before

* the response is sent. But the problem is the pending POST body data

* in the receive buffer of SSL (which Apache still has not read - it's

* pending until mod_cgi sucks it in). When mod_ssl now tries to perform

* the renegotiation the pending data leads to an I/O error.

*

* Solution Idea:

*

* There are only two solutions: Either to simply state that POST

* requests to URLs with SSL re-configurations are not allowed, or to

* renegotiate really after the _complete_ request (i.e. including

* the POST body) was read. Obviously the latter would be preferred,

* but it cannot be done easily inside Apache, because as already

* mentioned, there is no API step between the body reading and the body

* processing. And even when we mod_ssl would hook directly into the

* loop of mod_cgi, we wouldn't solve the problem for other handlers, of

* course. So the only general solution is to suck in the pending data

* of the request body from the OpenSSL BIO into the Apache BUFF. Then

* the renegotiation can be done and after this step Apache can proceed

* processing the request as before.

*

* Solution Implementation:

*

* We cannot simply suck in the data via an SSL_read-based loop because of

* HTTP chunking. Instead we _have_ to use the Apache API for this step which

* is aware of HTTP chunking. So the trick is to suck in the pending request

* data via the Apache API (which uses Apache's BUFF code and in the

* background mod_ssl's I/O glue code) and re-inject it later into the Apache

* BUFF code again. This way the data flows twice through the Apache BUFF, of

* course. But this way the solution doesn't depend on any Apache specifics

* and is fully transparent to Apache modules.

*

* !! BUT ALL THIS IS STILL NOT RE-IMPLEMENTED FOR APACHE 2.0 !!

*/

if (renegotiate && !renegotiate_quick && (r->method_number == M_POST)) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"SSL Re-negotiation in conjunction "

"with POST method not supported! "

"hint: try SSLOptions +OptRenegotiate");

return HTTP_METHOD_NOT_ALLOWED;

}

/*

* now do the renegotiation if anything was actually reconfigured

*/

if (renegotiate) {

/*

* Now we force the SSL renegotation by sending the Hello Request

* message to the client. Here we have to do a workaround: Actually

* OpenSSL returns immediately after sending the Hello Request (the

* intent AFAIK is because the SSL/TLS protocol says it's not a must

* that the client replies to a Hello Request). But because we insist

* on a reply (anything else is an error for us) we have to go to the

* ACCEPT state manually. Using SSL_set_accept_state() doesn't work

* here because it resets too much of the connection. So we set the

* state explicitly and continue the handshake manually.

*/

ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,

"Requesting connection re-negotiation");

if (renegotiate_quick) {

STACK_OF(X509) *cert_stack;

/* perform just a manual re-verification of the peer */

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,

"Performing quick renegotiation: "

"just re-verifying the peer");

cert_stack = (STACK_OF(X509) *)SSL_get_peer_cert_chain(ssl);

cert = SSL_get_peer_certificate(ssl);

if (!cert_stack && cert) {

/* client cert is in the session cache, but there is

* no chain, since ssl3_get_client_certificate()

* sk_X509_shift-ed the peer cert out of the chain.

* we put it back here for the purpose of quick_renegotiation.

*/

cert_stack = sk_new_null();

sk_X509_push(cert_stack, MODSSL_PCHAR_CAST cert);

}

if (!cert_stack || (sk_X509_num(cert_stack) == 0)) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Cannot find peer certificate chain");

return HTTP_FORBIDDEN;

}

if (!(cert_store ||

(cert_store = SSL_CTX_get_cert_store(ctx))))

{

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Cannot find certificate storage");

return HTTP_FORBIDDEN;

}

if (!cert) {

cert = sk_X509_value(cert_stack, 0);

}

X509_STORE_CTX_init(&cert_store_ctx, cert_store, cert, cert_stack);

depth = SSL_get_verify_depth(ssl);

if (depth >= 0) {

X509_STORE_CTX_set_depth(&cert_store_ctx, depth);

}

X509_STORE_CTX_set_ex_data(&cert_store_ctx,

SSL_get_ex_data_X509_STORE_CTX_idx(),

(char *)ssl);

if (!modssl_X509_verify_cert(&cert_store_ctx)) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Re-negotiation verification step failed");

ssl_log_ssl_error(APLOG_MARK, APLOG_ERR, r->server);

}

SSL_set_verify_result(ssl, cert_store_ctx.error);

X509_STORE_CTX_cleanup(&cert_store_ctx);

if (cert_stack != SSL_get_peer_cert_chain(ssl)) {

/* we created this ourselves, so free it */

sk_X509_pop_free(cert_stack, X509_free);

}

}

else {

request_rec *id = r->main ? r->main : r;

/* do a full renegotiation */

ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server,

"Performing full renegotiation: "

"complete handshake protocol");

SSL_set_session_id_context(ssl,

(unsigned char *)&id,

sizeof(id));

SSL_renegotiate(ssl);

SSL_do_handshake(ssl);

if (SSL_get_state(ssl) != SSL_ST_OK) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Re-negotiation request failed");

r->connection->aborted = 1;

return HTTP_FORBIDDEN;

}

ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,

"Awaiting re-negotiation handshake");

SSL_set_state(ssl, SSL_ST_ACCEPT);

SSL_do_handshake(ssl);

if (SSL_get_state(ssl) != SSL_ST_OK) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Re-negotiation handshake failed: "

"Not accepted by client!?");

r->connection->aborted = 1;

return HTTP_FORBIDDEN;

}

}

/*

* Remember the peer certificate's DN

*/

if ((cert = SSL_get_peer_certificate(ssl))) {

if (sslconn->client_cert) {

X509_free(sslconn->client_cert);

}

sslconn->client_cert = cert;

sslconn->client_dn = NULL;

}

/*

* Finally check for acceptable renegotiation results

*/

if (dc->nVerifyClient != SSL_CVERIFY_NONE) {

BOOL do_verify = (dc->nVerifyClient == SSL_CVERIFY_REQUIRE);

if (do_verify && (SSL_get_verify_result(ssl) != X509_V_OK)) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Re-negotiation handshake failed: "

"Client verification failed");

return HTTP_FORBIDDEN;

}

if (do_verify) {

if ((peercert = SSL_get_peer_certificate(ssl)) == NULL) {

ap_log_error(APLOG_MARK, APLOG_ERR, 0, r->server,

"Re-negotiation handshake failed: "

"Client certificate missing");

return HTTP_FORBIDDEN;

}

X509_free(peercert);

}

}

/*

* Also check that SSLCipherSuite has been enforced as expected.

*/

if (cipher_list) {

cipher = SSL_get_current_cipher(ssl);

if (sk_SSL_CIPHER_find(cipher_list, cipher) < 0) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"SSL cipher suite not renegotiated: "

"access to %s denied using cipher %s",

r->filename,

SSL_CIPHER_get_name(cipher));

return HTTP_FORBIDDEN;

}

}

}

/* If we're trying to have the user name set from a client

* certificate then we need to set it here. This should be safe as

* the user name probably isn't important from an auth checking point

* of view as the certificate supplied acts in that capacity.

* However, if FakeAuth is being used then this isn't the case so

* we need to postpone setting the username until later.

*/

if ((dc->nOptions & SSL_OPT_FAKEBASICAUTH) == 0 && dc->szUserName) {

char *val = ssl_var_lookup(r->pool, r->server, r->connection,

r, (char *)dc->szUserName);

if (val && val[0])

r->user = val;

}

/*

* Check SSLRequire boolean expressions

*/

requires = dc->aRequirement;

ssl_requires = (ssl_require_t *)requires->elts;

for (i = 0; i < requires->nelts; i++) {

ssl_require_t *req = &ssl_requires[i];

ok = ssl_expr_exec(r, req->mpExpr);

if (ok < 0) {

cp = apr_psprintf(r->pool,

"Failed to execute "

"SSL requirement expression: %s",

ssl_expr_get_error());

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"access to %s failed, reason: %s",

r->filename, cp);

/* remember forbidden access for strict require option */

apr_table_setn(r->notes, "ssl-access-forbidden", "1");

return HTTP_FORBIDDEN;

}

if (ok != 1) {

ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,

"Access to %s denied for %s "

"(requirement expression not fulfilled)",

r->filename, r->connection->remote_ip);

ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,

"Failed expression: %s", req->cpExpr);

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"access to %s failed, reason: %s",

r->filename,

"SSL requirement expression not fulfilled "

"(see SSL logfile for more details)");

/* remember forbidden access for strict require option */

apr_table_setn(r->notes, "ssl-access-forbidden", "1");

return HTTP_FORBIDDEN;

}

}

/*

* Else access is granted from our point of view (except vendor

* handlers override). But we have to return DECLINED here instead

* of OK, because mod_auth and other modules still might want to

* deny access.

*/

return DECLINED;

}

/*

* Authentication Handler:

* Fake a Basic authentication from the X509 client certificate.

*

* This must be run fairly early on to prevent a real authentication from

* occuring, in particular it must be run before anything else that

* authenticates a user. This means that the Module statement for this

* module should be LAST in the Configuration file.

*/

int ssl_hook_UserCheck(request_rec *r)

{

SSLConnRec *sslconn = myConnConfig(r->connection);

SSLSrvConfigRec *sc = mySrvConfig(r->server);

SSLDirConfigRec *dc = myDirConfig(r);

char *clientdn;

const char *auth_line, *username, *password;

/*

* Additionally forbid access (again)

* when strict require option is used.

*/

if ((dc->nOptions & SSL_OPT_STRICTREQUIRE) &&

(apr_table_get(r->notes, "ssl-access-forbidden")))

{

return HTTP_FORBIDDEN;

}

/*

* We decline when we are in a subrequest. The Authorization header

* would already be present if it was added in the main request.

*/

if (!ap_is_initial_req(r)) {

return DECLINED;

}

/*

* Make sure the user is not able to fake the client certificate

* based authentication by just entering an X.509 Subject DN

* ("/XX=YYY/XX=YYY/..") as the username and "password" as the

* password.

*/

if ((auth_line = apr_table_get(r->headers_in, "Authorization"))) {

if (strcEQ(ap_getword(r->pool, &auth_line, ' '), "Basic")) {

while ((*auth_line == ' ') || (*auth_line == '\t')) {

auth_line++;

}

auth_line = ap_pbase64decode(r->pool, auth_line);

username = ap_getword_nulls(r->pool, &auth_line, ':');

password = auth_line;

if ((username[0] == '/') && strEQ(password, "password")) {

ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r,

"Encountered FakeBasicAuth spoof: %s", username);

return HTTP_FORBIDDEN;

}

}

}

/*

* We decline operation in various situations...

* - SSLOptions +FakeBasicAuth not configured

* - r->user already authenticated

* - ssl not enabled

* - client did not present a certificate

*/

if (!(sc->enabled && sslconn && sslconn->ssl && sslconn->client_cert) ||

!(dc->nOptions & SSL_OPT_FAKEBASICAUTH) || r->user)

{

return DECLINED;

}

if (!sslconn->client_dn) {

X509_NAME *name = X509_get_subject_name(sslconn->client_cert);

char *cp = X509_NAME_oneline(name, NULL, 0);

sslconn->client_dn = apr_pstrdup(r->connection->pool, cp);

modssl_free(cp);

}

clientdn = (char *)sslconn->client_dn;

/*

* Fake a password - which one would be immaterial, as, it seems, an empty

* password in the users file would match ALL incoming passwords, if only

* we were using the standard crypt library routine. Unfortunately, OpenSSL

* "fixes" a "bug" in crypt and thus prevents blank passwords from

* working. (IMHO what they really fix is a bug in the users of the code

* - failing to program correctly for shadow passwords). We need,

* therefore, to provide a password. This password can be matched by

* adding the string "xxj31ZMTZzkVA" as the password in the user file.

* This is just the crypted variant of the word "password" ;-)

*/

auth_line = apr_pstrcat(r->pool, "Basic ",

ap_pbase64encode(r->pool,

apr_pstrcat(r->pool, clientdn,

":password", NULL)),

NULL);

apr_table_set(r->headers_in, "Authorization", auth_line);

ap_log_error(APLOG_MARK, APLOG_INFO, 0, r->server,

"Faking HTTP Basic Auth header: \"Authorization: %s\"",

auth_line);

return DECLINED;

}

/* authorization phase */

int ssl_hook_Auth(request_rec *r)

{

SSLDirConfigRec *dc = myDirConfig(r);

/*

* Additionally forbid access (again)

* when strict require option is used.

*/

if ((dc->nOptions & SSL_OPT_STRICTREQUIRE) &&

(apr_table_get(r->notes, "ssl-access-forbidden")))

{

return HTTP_FORBIDDEN;

}

return DECLINED;

}

/*

* Fixup Handler

*/

static const char *ssl_hook_Fixup_vars[] = {

"SSL_VERSION_INTERFACE",

"SSL_VERSION_LIBRARY",

"SSL_PROTOCOL",

"SSL_CIPHER",

"SSL_CIPHER_EXPORT",

"SSL_CIPHER_USEKEYSIZE",

"SSL_CIPHER_ALGKEYSIZE",

"SSL_CLIENT_VERIFY",

"SSL_CLIENT_M_VERSION",

"SSL_CLIENT_M_SERIAL",

"SSL_CLIENT_V_START",

"SSL_CLIENT_V_END",

"SSL_CLIENT_S_DN",

"SSL_CLIENT_S_DN_C",

"SSL_CLIENT_S_DN_ST",

"SSL_CLIENT_S_DN_L",

"SSL_CLIENT_S_DN_O",

"SSL_CLIENT_S_DN_OU",

"SSL_CLIENT_S_DN_CN",

"SSL_CLIENT_S_DN_T",

"SSL_CLIENT_S_DN_I",

"SSL_CLIENT_S_DN_G",

"SSL_CLIENT_S_DN_S",

"SSL_CLIENT_S_DN_D",

"SSL_CLIENT_S_DN_UID",

"SSL_CLIENT_S_DN_Email",

"SSL_CLIENT_I_DN",

"SSL_CLIENT_I_DN_C",

"SSL_CLIENT_I_DN_ST",

"SSL_CLIENT_I_DN_L",

"SSL_CLIENT_I_DN_O",

"SSL_CLIENT_I_DN_OU",

"SSL_CLIENT_I_DN_CN",

"SSL_CLIENT_I_DN_T",

"SSL_CLIENT_I_DN_I",

"SSL_CLIENT_I_DN_G",

"SSL_CLIENT_I_DN_S",

"SSL_CLIENT_I_DN_D",

"SSL_CLIENT_I_DN_UID",

"SSL_CLIENT_I_DN_Email",

"SSL_CLIENT_A_KEY",

"SSL_CLIENT_A_SIG",

"SSL_SERVER_M_VERSION",

"SSL_SERVER_M_SERIAL",

"SSL_SERVER_V_START",

"SSL_SERVER_V_END",

"SSL_SERVER_S_DN",

"SSL_SERVER_S_DN_C",

"SSL_SERVER_S_DN_ST",

"SSL_SERVER_S_DN_L",

"SSL_SERVER_S_DN_O",

"SSL_SERVER_S_DN_OU",

"SSL_SERVER_S_DN_CN",

"SSL_SERVER_S_DN_T",

"SSL_SERVER_S_DN_I",

"SSL_SERVER_S_DN_G",

"SSL_SERVER_S_DN_S",

"SSL_SERVER_S_DN_D",

"SSL_SERVER_S_DN_UID",

"SSL_SERVER_S_DN_Email",