SSL environment access

[rcbarnett-zz]

MODSEC-220: The ENV collection cannot access environment variables set by mod_ssl.
It would be useful to extend it (or add another collection)

[rcbarnett-zz]

Original reporter: marcstern

[rcbarnett-zz]

rbarnett: Marc - did you set the "SSLOptions StdEnvVars" directive to export the SSL data - http://httpd.apache.org/docs/2.0/mod/mod_ssl.html#ssloptions

[rcbarnett-zz]

marcstern: SSLVerifyClient require
SSLOptions +StdEnvVars +ExportCertData
SecRule ENV:SSL_CLIENT_S_DN "(.*)"
"phase:2,pass,nolog,t:none,capture,setenv:SSL_CLIENT_S_DN2=%{TX.1}"

Rule 453ba38: SecRule "ENV:SSL_CLIENT_S_DN" "@rx (.*)" "phase:2,pass,nolog,t:none,capture,setenv:SSL_CLIENT_S_DN2=%{TX.1}"
Rule returned 0.

[zimmerle]

SSL variables are available via ENV variable. No need to have this feature duplicated on ModSecurity.

[marcstern]

You currently cannot test a SSL variable like ENV:SSL_CLIENT_S_DN_CN

[zimmerle]

You currently cannot test a SSL variable like ENV:SSL_CLIENT_S_DN_CN

What you meant by DN_CN? All the client_s variables are correctly populated by SSL. As long as you have the client authentication is enabled, those variable will be populated accordingly.

https://httpd.apache.org/docs/2.4/mod/mod_ssl.html#page-header

[marcstern]

client_s variables are correctly populated by SSL
Yes, but in the "SSL" space which is not available to ModSecurity rules