You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2008/09/24 15:35:48 UTC
DO NOT REPLY [Bug 45875] New: X509 DN components with multiple
occurence not available to apr_table_get
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Summary: X509 DN components with multiple occurence not available
to apr_table_get
Product: Apache httpd-2
Version: 2.2.9
Platform: PC
OS/Version: Linux
Status: NEW
Severity: major
Priority: P2
Component: mod_ssl
AssignedTo: bugs@httpd.apache.org
ReportedBy: weisz@vcpc.univie.ac.at
apr_table_get retrieves the values stored in a table whose contents are defined
by the array ssl_hook_Fixup_vars[] defined in modules/ssl/ssl_engine_kernel.c.
This array is used by the function ssl_hook_Fixup() purely as is, and thus the
generated table doesn't have entries for multiple occurences of X509 DN
components (e.g. SSL_CLIENT_S_DN_OU_n, n being a non-negative integer).
This table provides through the use of function apr_table_get() access to the
contents of certificates to external functions like PHP's apache_getenv() which
are thus unable to retrieve components that occur multiple times in a DN,
except for the first occurance.
Please amend ssl_hook_Fixup() to also take care of these multiple occurences.
The function ssl_var_lookup() called inside ssl_hook_Fixup() can already return
the correct value, but ssl_hook_Fixup() has to provide the table entry.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Willy Weisz <we...@vcpc.univie.ac.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
--- Comment #12 from Willy Weisz <we...@vcpc.univie.ac.at> 2011-02-12 17:34:53 EST ---
(In reply to comment #11)
> You're correct. I've fixed the manual - r1070094
You fixed the manual by inserting that <DN_component> should contain the same
value as <DN_component>_0, but the code is still in error.
<DN_component>_0 is still not provided, only <DN_component> which contains the
same value as <DN_component>_0 should.
The following values are extracted from the output of phpinfo():
SSL_CLIENT_S_DN /C=AT/O=AustrianGrid/OU=UniVie/OU=VCPC/CN=Willy Weisz
SSL_CLIENT_S_DN_OU UniVie
SSL_CLIENT_S_DN_OU_1 VCPC
but SSL_CLIENT_S_DN_OU_0 is missing!!!!
Also the PHP function apache_getenv("SSL_CLIENT_S_DN_OU_0") doesn't return
anything.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
--- Comment #4 from Joe Orton <jo...@redhat.com> 2008-09-30 13:07:16 PST ---
It would be useful to do this, certainly.
The attached patch would I think almost double the cost of ssl_hook_Fixups()
with +ExportCertData because it would invoke ssl_var_lookup_ssl_cert_dn() at
least twice for each DN suffix in the Fixup_vars array, and _ssl_cert_dn()
iterates potentially over the entire X509_NAME array for each invocation -- not
cheap.
I'd really really rather see a patch to rewrite the Fixup code to instead
iterate through the X509_NAME *once* for each of the four (server, client) *
(subj, issuer) DNs, which could for each:
- check the NID against a table of the NIDs to export
- if it's one to export, do a cheap reverse lookup to get a varname suffix
- and count entries so that for multiple DNs the _N suffix gets added
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
--- Comment #5 from Joe Orton <jo...@redhat.com> 2008-10-01 08:50:37 PST ---
Created an attachment (id=22660)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=22660)
cleanly extract DN to environment
Can you try this patch? This extracts the DN in an efficient fashion and
should handle multiple RDNs with the same NID tag.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #9 from Joe Orton <jo...@redhat.com> 2010-06-08 08:09:32 EDT ---
The patch you proposed was particularly inefficient, and in a way that
everybody would suffer a potential performance loss to fix this bug.
The patch referenced in comment 7 is included in 2.2.15, so, please try that.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 45875] X509 DN components with multiple occurence not available
to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Kaspar Brand <as...@velox.ch> changed:
What |Removed |Added
----------------------------------------------------------------------------
Hardware|PC |All
OS|Linux |All
--- Comment #17 from Kaspar Brand <as...@velox.ch> ---
Backported to 2.2.15 with r910319.
Regression fix for 2.2.x: see bug 54510.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Willy Weisz <we...@vcpc.univie.ac.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |weisz@vcpc.univie.ac.at
--- Comment #3 from Willy Weisz <we...@vcpc.univie.ac.at> 2008-09-28 13:17:58 PST ---
(In reply to comment #2)
> Please do not change the assignment of bugs as this cuts of the bugs@ mailing
> list which is watched by many people to notice changes to bugs.
>
Sorry. I misunderstood the assignment changes and their consequences.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Willy Weisz <we...@vcpc.univie.ac.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
--- Comment #15 from Willy Weisz <we...@vcpc.univie.ac.at> 2011-02-15 11:45:41 EST ---
(In reply to comment #14)
> SSL_CLIENT_S_DN_OU UniVie
> SSL_CLIENT_S_DN_OU_1 VCPC
>
> How is that "in error"? That is exactly as described and expected:
>
> "When the environment table is populated using the StdEnvVars option of the
> SSLOptions directive, the first (or only) attribute of any DN is added only
> under a non-suffixed name; i.e. no _0 suffixed entries are added."
>
> Populating the env table with duplicate _0 entries is unnecessary - the code
> has never worked that way so there can be no expectation that it should. You
> can use the _0 names if accessing the variables directly through the C
> ssl_var_lookup API (or Perl equivalent).
Your new description reads:
--
suffix. If the DN in question contains multiple attributes of the
+same name, this suffix is used as a zero-based index to select a
+particular attribute. For example, where the server certificate
+subject DN included two OU attributes, <code>SSL_SERVER_S_DN_OU_0</code>
+and
+<code>SSL_SERVER_S_DN_OU_1</code> could be used to reference each. A
+variable name without a <code>_n</code> suffix is equivalent to that
+name with a <code>_0</code> suffix; the first (or only) attribute.
+When the environment table is populated using
+the <code>StdEnvVars</code> option of
+the <code class="directive"><a href="#ssloptions">SSLOptions</a></code>
directive, the
+first (or only) attribute of any DN is added only under a non-suffixed
+name; i.e. no <code>_0</code> suffixed entries are added.</p>
--
The normal understanding of the last sentence in its context is that only when
StdEnvVars is set the xxx_0 entry is omitted in the environment table, whereas
you mean that in the environment table, which is only created when StdEnvVars
is set, it is always omitted. I therefore suggest to rephrase the text to read:
"Nevertheless, in the environment table, created as a result of using the
<code>StdEnvVars</code> option of the <code class="directive"><a
href="#ssloptions">SSLOptions</a></code> directive, the first (or only)
attribute of any DN is added only under a non-suffixed name; i.e. no
<code>_0</code> suffixed entries are added.</p>".
Concerning your statement "the code has never worked that way so there can be
no expectation that it should", let me remind you that the code didn't work
"that way" nor any other way according to the specification stated in the
original 2.2 documentation before I opened this bug report and submitted a
first - be it very inefficient - patch. With the new definition you give in the
patched documentation you partly redefined the original specification to suit
your code. And you justify this approach by claiming that the xxx_0 entry is
unnecessary.
I strongly object to your argument: Having an environment entry with index 0
helps streamlining scripts retrieving environment variables through
apr_table_get() directly or indirectly (e.g. the PHP function apache_getenv())
to a large extent. The little bit of redundancy overhead introduced by adding
the index-zero entry is by far outweighed by the improved ease of writing
scripts analysing the certificate entries with loops running through the whole
array, and not having to single out the first entry of the array.
If you think that my objection to your after-the-code specification should be
started in a new bugzilla entry, I'll do that.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #16 from Joe Orton <jo...@redhat.com> 2011-02-16 09:19:15 EST ---
Having a dupe _0 entry *is* unnecessary. It adds no information which is
currently absent. Coding a "no-suffix, _1, _2, ..." loop is not the most
complicated thing in the world. Few people care about handling multi-attrib
DNs. Many people would be impacted - in a slight way - by adding the _0
duplicates. This is a trade-off, and one I am happy with. If you wish to
propose an alternative send a patch to dev@ and it can be debated on the list,
but please don't re-open this bug.
The docs text you propose seems to be semantically identical to the current
text; I'm not sure what the issue is there.
If you care about using this stuff from PHP it would be better to add an
accessor function to PHP for ssl_var_lookup() rather than relying on use of
+StdEnvVars in the first place.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Willy Weisz <we...@vcpc.univie.ac.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
--- Comment #8 from Willy Weisz <we...@vcpc.univie.ac.at> 2009-08-17 03:54:05 PDT ---
(In reply to comment #5)
> Created an attachment (id=22660) [details]
> cleanly extract DN to environment
>
> Can you try this patch? This extracts the DN in an efficient fashion and
> should handle multiple RDNs with the same NID tag.
I'm sorry for the late reply. My first attempts at installing the patch failed,
and I thought that this was because I used an older version of apache2. Then I
had to concentrate on other stuff.
I'm now coming back to the project that needs the correct functioning of the DN
extraction. So I tried to install the patch with the newest published version
of apache2 2.2.13. It still fails because it is based on a version of
ssl_engine_vars.c and ssl_private.h which have never been published, but seem
to be your private one.
Secondly I wonder why the correction of a clear bug of apache2 hasn't been
implemented in the current version 2.2.13 which was published much later than
my bug report, even if a working patch may be less elegant than your proposal -
but providing what the official documentation claims.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEEDINFO |RESOLVED
Resolution| |FIXED
--- Comment #7 from Joe Orton <jo...@redhat.com> 2008-12-09 06:44:06 PST ---
The patch seems to work fine, so committed to trunk, r724717 ( https://svn.apache.org/viewcvs.cgi?view=rev&rev=724717 ).
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Ruediger Pluem <rp...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #14 from Joe Orton <jo...@redhat.com> 2011-02-15 10:28:03 EST ---
SSL_CLIENT_S_DN_OU UniVie
SSL_CLIENT_S_DN_OU_1 VCPC
How is that "in error"? That is exactly as described and expected:
"When the environment table is populated using the StdEnvVars option of the
SSLOptions directive, the first (or only) attribute of any DN is added only
under a non-suffixed name; i.e. no _0 suffixed entries are added."
Populating the env table with duplicate _0 entries is unnecessary - the code
has never worked that way so there can be no expectation that it should. You
can use the _0 names if accessing the variables directly through the C
ssl_var_lookup API (or Perl equivalent).
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #6 from Joe Orton <jo...@redhat.com> 2008-11-26 05:51:55 PST ---
Could you try out the patch?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Joe Orton <jo...@redhat.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|REOPENED |RESOLVED
Resolution| |FIXED
--- Comment #11 from Joe Orton <jo...@redhat.com> 2011-02-12 10:41:51 EST ---
You're correct. I've fixed the manual - r1070094
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Willy Weisz <we...@vcpc.univie.ac.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|RESOLVED |REOPENED
Resolution|FIXED |
--- Comment #10 from Willy Weisz <we...@vcpc.univie.ac.at> 2010-06-08 13:21:12 EDT ---
(In reply to comment #9)
> The patch you proposed was particularly inefficient, and in a way that
> everybody would suffer a potential performance loss to fix this bug.
>
> The patch referenced in comment 7 is included in 2.2.15, so, please try that.
It produces only a partially correct result: the first of a repeated DN
component isn't returned as component number 0 (zero) as described by the
manual, but only as the component itself - e.g. OU and OU_1 are returned, but
not OU_0.
Even so it's not explicitly stated in the manual a mono-valued DN component
should also be returned as that component with value 0, e.g. OU_0 should be
returned alongside OU even if only one OU component is present in a DN - this
would make the use of the feature more programming friendly.
By the way, my patch may have been "particularly inefficient", but at least it
produced a completely correct result according to the manual.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Ruediger Pluem <rp...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
AssignedTo|weisz@vcpc.univie.ac.at |bugs@httpd.apache.org
Status|REOPENED |NEW
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
--- Comment #13 from Willy Weisz <we...@vcpc.univie.ac.at> 2011-02-12 17:50:29 EST ---
I forgot to mention that the bug exists up to version 2.2.17.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 45875] X509 DN components with multiple occurence
not available to apr_table_get
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=45875
Willy Weisz <we...@vcpc.univie.ac.at> changed:
What |Removed |Added
----------------------------------------------------------------------------
AssignedTo|bugs@httpd.apache.org |weisz@vcpc.univie.ac.at
Status|NEW |ASSIGNED
--- Comment #1 from Willy Weisz <we...@vcpc.univie.ac.at> 2008-09-28 12:22:11 PST ---
Created an attachment (id=22643)
--> (https://issues.apache.org/bugzilla/attachment.cgi?id=22643)
Patch to fix bug 45875
Bug fixed
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org