diff options
| author |   beck <beck@openbsd.org> | 2001-03-29 10:21:21 +0000 |
|---|---|---|
| committer | beck <beck@openbsd.org> | 2001-03-29 10:21:21 +0000 |
| commit | 57e0a168d0faa875be76de9a8acb9c5001529d13 (patch) | |
| tree | da8be0c6d7918e1e30df1548d533d4b8145a61a5 /usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c | |
| parent | new apache manual dirs for 1.3.19 (diff) | |
| download | wireguard-openbsd-57e0a168d0faa875be76de9a8acb9c5001529d13.tar.xz wireguard-openbsd-57e0a168d0faa875be76de9a8acb9c5001529d13.zip | |
Apache 1.3.19+mod_ssl 2.8.1 merge - also adds shared build of mod_headers
and mod_expire
Diffstat (limited to 'usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c')
| -rw-r--r-- | usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c b/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c index 63659252e28..8e711525a66 100644 --- a/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c +++ b/usr.sbin/httpd/src/modules/ssl/ssl_engine_kernel.c @@ -9,7 +9,7 @@ */ /* ==================================================================== - * Copyright (c) 1998-2000 Ralf S. Engelschall. All rights reserved. + * Copyright (c) 1998-2001 Ralf S. Engelschall. All rights reserved. * * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions @@ -1098,6 +1098,9 @@ int ssl_hook_Auth(request_rec *r) SSLDirConfigRec *dc = myDirConfig(r); char b1[MAX_STRING_LEN], b2[MAX_STRING_LEN]; char *clientdn; + const char *cpAL; + const char *cpUN; + const char *cpPW; /* * Additionally forbid access (again) @@ -1108,6 +1111,24 @@ int ssl_hook_Auth(request_rec *r) return FORBIDDEN; /* + * Make sure the user is not able to fake the client certificate + * based authentication by just entering an X.509 Subject DN + * ("/XX=YYY/XX=YYY/..") as the username and "password" as the + * password. + */ + if ((cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) { + if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) { + while (*cpAL == ' ' || *cpAL == '\t') + cpAL++; + cpAL = ap_pbase64decode(r->pool, cpAL); + cpUN = ap_getword_nulls(r->pool, &cpAL, ':'); + cpPW = cpAL; + if (cpUN[0] == '/' && strEQ(cpPW, "password")) + return FORBIDDEN; + } + } + + /* * We decline operation in various situations... */ if (!sc->bEnabled) |