Re: Restricting access by arbitrary certificate extension

Zhumabekov - discussion of mod_ssl for httpd 2.x takes place on the=20
deveopment list for Apache httpd, CC'ed.  (I'm quoting the full mail=20
inline for reference of dev@ readers)

On Wed, May 06, 2009 at 10:49:46AM +0600, Zhumabekov Yerden wrote:
>            mod_ssl can perform client authentication on certificate in =
=20
> Apache and client authorization on certain certificate extensions. We =20
> are setting up CA here and we want to restrict access to certain websit=
e =20
> by checking the presence of certain certificate extension using its OID=
. =20
> The syntax which mod_ssl is forcing us to use is the following:
>
>            <Location />
>            SSLRequire =E2=80=9Csome string=E2=80=9D in OID(=E2=80=9C1.2=
.3.4=E2=80=A6..=E2=80=9D)
>            </Location>
>
> As you can see, we need to match this string exactly in extension=E2=80=
=99s =20
> value. We can encounter problem with this, because this extension may =20
> not be listed in openssl list of valid extensions =20
> (crypto/objects/objects.h). As I learned the mod_ssl and openssl code, =
=20
> mod_ssl would not be able to match the string because the object of thi=
s =20
> OID does not have valid NID in openssl. OpenSSL seems incapable of =20
> determining the type of arbitrary extension we want to use as =20
> restricting factor. Hence, mod_ssl can not even extract its value from =
=20
> certificate.
>            Well, I poked around the problem for some time and found no =
=20
> other way than to patch mod_ssl by adding one new function in =20
> ssl_expr_eval.c which does almost the same thing as ssl_extlist_by_oid(=
) =20
> and ssl_expr_eval_oid() but does not intend to extract the value of =20
> certificate extension. I also added some change to ssl_expr_eval_comp()=
, =20
> so if you supply the zero-length word in SSLRequire, it uses my new =20
> function instead of ssl_expr_eval_oid(). So, the new syntax is like thi=
s:
>
>            <Location />
>            SSLRequire =E2=80=9C=E2=80=9D in OID(=E2=80=9C1.2.3.4=E2=80=A6=
..=E2=80=9D)
>            </Location>
>
>            If you are aware of more attractive and =E2=80=9Cright=E2=80=
=9D way to make =20
> it, please acknowledge. My patch for apache-2.2.11 is attached.

I'd rather see a different syntax used for the new semantics, such as:

   SSLRequire has_oid("1.2.3.4")

though I'm not sure whether the SSLRequire parser can cope with that.

Regards, Joe
______________________________________________________________________
Apache Interface to OpenSSL (mod_ssl)                   www.modssl.org
User Support Mailing List                      [email protected]
Automated List Manager                            [email protected]