You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2011/05/09 10:39:49 UTC

DO NOT REPLY [Bug 51174] New: SSLRequire predicates using OIDs unknown to openssl

https://issues.apache.org/bugzilla/show_bug.cgi?id=51174

             Bug #: 51174
           Summary: SSLRequire predicates using OIDs unknown to openssl
           Product: Apache httpd-2
           Version: 2.2.17
          Platform: All
        OS/Version: Linux
            Status: NEW
          Severity: minor
          Priority: P2
         Component: mod_ssl
        AssignedTo: bugs@httpd.apache.org
        ReportedBy: daniele.gozzi@gmail.com
    Classification: Unclassified


Created attachment 26975
  --> https://issues.apache.org/bugzilla/attachment.cgi?id=26975
"works for me" patch

By calling X509V3_EXT_print() with a null flags argument in
modules/ssl/ssl_expr_eval.c: ssl_extlist_by_oid() it is not possible to express
conditions on arbitrary OIDs, as in 

SSLRequire file("/a/file") in OID("1.3.6.1.4.1.311.21.10")

I propose the attached patch to address the problem.

Be aware that the OID values in val_array are compared using strcmp() in
ssl_expr_eval_oid(), so a null byte may disrupt the check. I wasn't able to
find evidence about the chance of having a null byte in ASN.1, so the patch
only counts as a "works for me" solution.

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

[Bug 51174] SSLRequire predicates using OIDs unknown to openssl

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51174

--- Comment #1 from Joe Orton <jo...@redhat.com> ---
This is done, though slightly differently, in 2.4.x; thanks for sending in the
patch.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org

DO NOT REPLY [Bug 51174] SSLRequire predicates using OIDs unknown to openssl

Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=51174

Daniele Gozzi <da...@gmail.com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |daniele.gozzi@gmail.com

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org