Mailing-List: contact docs-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: docs@httpd.apache.org
From: bugzilla@apache.org
To: docs@httpd.apache.org
Subject: DO NOT REPLY [Bug 52644] New: document how SSL FakeBasicAuth works
 with strange characters in DNs and with groupfiles
Date: Sun, 12 Feb 2012 03:39:27 +0000
Message-ID: <bug-52644-56585@https.issues.apache.org/bugzilla/>
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0

https://issues.apache.org/bugzilla/show_bug.cgi?id=3D52644

             Bug #: 52644
           Summary: document how SSL FakeBasicAuth works with strange
                    characters in DNs and with groupfiles
           Product: Apache httpd-2
           Version: 2.2.20
          Platform: PC
        OS/Version: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Documentation
        AssignedTo: docs@httpd.apache.org
        ReportedBy: calestyo@scientia.net
    Classification: Unclassified


Hi.

Could you please share some light (and add to the documentation at
https://httpd.apache.org/docs/current/mod/mod_ssl.html#ssloptions if and how
mod_ssl's FakeBasicAuth feature works with the following:

a) Special characters
A certificates DN can contain basically _ANY_ character, including =E2=80=
=9C:=E2=80=9D, =E2=80=9C/=E2=80=9D, =E2=80=9C
=E2=80=9D, =E2=80=9C"=E2=80=9D or any weird Unicode character from any scri=
pt.
As far as I can see this could affect us at least in the following places:
- user file
There at least the colon seems to have the special meaning of separating the
username from the password, e.g.:
/C=3DDE/O=3DGermanGrid/OU=3DLMU/CN=3DChristoph Anton
Mitterer:$apr1$7DksooGS$Mz9EkgYft12dREFb1gk8b.
Maybe =E2=80=9C$=E2=80=9D, =E2=80=9C.=E2=80=9D or the other characters ment=
ioned above have also special
meanigns?!

Given that this is really security relevant, could you please document whet=
her
all this is _always_ safe for any characters in the DN or not?!

Guess this would mean that the parsing has to work like this regexp ^(.*):(=
.*)$
and the matching must be "greedy" (i.e. the _last_ =E2=80=9C:=E2=80=9D) mus=
t be matched.


b) DNs in group files
Here things seem to be even more weird.
DNs typically contain =E2=80=9C =E2=80=9D characters (spaces).
The space however is the separation characters in the group files.

I found out that quoting the DN with =E2=80=9C"=E2=80=9D seems to work.
This is however not (yet) documented.
Further,.. is this safe? I mean, DNs could be made up tricky, containing =
=E2=80=9C"=E2=80=9D or
=E2=80=9C:=E2=80=9D to confuse the parsing of the group files.
This could even be a security problem.


Cheers,
Chris.

--=20
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=3De=
mail
------- You are receiving this mail because: -------
You are the assignee for the bug.=

---------------------------------------------------------------------
To unsubscribe, e-mail: docs-unsubscribe@httpd.apache.org
For additional commands, e-mail: docs-help@httpd.apache.org