From: Joe Orton A number of additional environment variables can also be used
+in In these contexts, two special formats can also be used: while for For The The Standard CGI/1.0 and Apache variables: SSL-related variables: The string used for the object-ID can be either be a descriptive
+name as recognized by the SSL library, such as Expressions with types known to the SSL library are rendered to
+a string before comparison. For an extension with a type not
+recognized by the SSL library, mod_ssl will parse the value if it is
+one of the primitive ASN.1 type UTF8String, IA5String, VisibleString,
+or BMPString. For an extension of one of these types, the string
+value will be converted to UTF-8 if necessary, then compared against
+the left-hand-side expression. A number of additional environment variables can also be used
+in In these contexts, two special formats can also be used: while for For SSL_SERVER_S_DN_OU_0 and
SSL_CLIENT_V_REMAIN is only available in version 2.1
and later.SSLRequire expressions, or in custom log
+formats:HTTP_USER_AGENT PATH_INFO AUTH_TYPE
+HTTP_REFERER QUERY_STRING SERVER_SOFTWARE
+HTTP_COOKIE REMOTE_HOST API_VERSION
+HTTP_FORWARDED REMOTE_IDENT TIME_YEAR
+HTTP_HOST IS_SUBREQ TIME_MON
+HTTP_PROXY_CONNECTION DOCUMENT_ROOT TIME_DAY
+HTTP_ACCEPT SERVER_ADMIN TIME_HOUR
+THE_REQUEST SERVER_NAME TIME_MIN
+REQUEST_FILENAME SERVER_PORT TIME_SEC
+REQUEST_METHOD SERVER_PROTOCOL TIME_WDAY
+REQUEST_SCHEME REMOTE_ADDR TIME
+REQUEST_URI REMOTE_USER
+
+
ENV:variablenameHTTP:headernameCustom Log Formats
@@ -1549,7 +1578,7 @@ variable ::= "%{" varname "}"
function ::= funcname "(" funcargs ")"
-varname any variable from Table 3 can be used. Finally for
+varname any of the variables described in Environment Variables can be used. For
funcname the following functions are available:
file(filename)
@@ -1565,77 +1594,44 @@ Per-Server Class context expression is parsed at startup time and
at runtime only the machine representation is executed. For Per-Directory
context this is different: here expression has to be parsed and
immediately executed for every request.
+Example
SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
+ and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+ and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+ and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+ and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
+ or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/PeerExtList(object-ID) function expects
+to find zero or more instances of the X.509 certificate extension
+identified by the given object ID in the client certificate.
+The expression evaluates to true if the left-hand side string matches
+exactly against the value of an extension identified with this OID.
+(If multiple extensions with the same OID are present, at least one
+extension must match).Example
-SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
- and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
- and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
- and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
- and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
- or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
+SSLRequire "foobar" in PeerExtList("1.2.3.4.5.6")
PeerExtList(object id) function expects to find
-zero or more instances of the X.509 Certificate Extension (as identified by
-the given object id) in the client certificate, and compares the
-left-hand side string against the value of any matching attribute value. Every
-extension with the specified object id is checked, until a match is found.
-
-HTTP_USER_AGENT PATH_INFO AUTH_TYPE
-HTTP_REFERER QUERY_STRING SERVER_SOFTWARE
-HTTP_COOKIE REMOTE_HOST API_VERSION
-HTTP_FORWARDED REMOTE_IDENT TIME_YEAR
-HTTP_HOST IS_SUBREQ TIME_MON
-HTTP_PROXY_CONNECTION DOCUMENT_ROOT TIME_DAY
-HTTP_ACCEPT SERVER_ADMIN TIME_HOUR
-HTTP:headername SERVER_NAME TIME_MIN
-THE_REQUEST SERVER_PORT TIME_SEC
-REQUEST_METHOD SERVER_PROTOCOL TIME_WDAY
-REQUEST_SCHEME REMOTE_ADDR TIME
-REQUEST_URI REMOTE_USER ENV:variablename
-REQUEST_FILENAME
-
-
-HTTPS SSL_CLIENT_M_VERSION SSL_SERVER_M_VERSION
- SSL_CLIENT_M_SERIAL SSL_SERVER_M_SERIAL
-SSL_PROTOCOL SSL_CLIENT_V_START SSL_SERVER_V_START
-SSL_SESSION_ID SSL_CLIENT_V_END SSL_SERVER_V_END
-SSL_SESSION_RESUMED SSL_CLIENT_S_DN SSL_SERVER_S_DN
-SSL_CIPHER SSL_CLIENT_S_DN_C SSL_SERVER_S_DN_C
-SSL_CIPHER_EXPORT SSL_CLIENT_S_DN_ST SSL_SERVER_S_DN_ST
-SSL_CIPHER_ALGKEYSIZE SSL_CLIENT_S_DN_L SSL_SERVER_S_DN_L
-SSL_CIPHER_USEKEYSIZE SSL_CLIENT_S_DN_O SSL_SERVER_S_DN_O
-SSL_VERSION_LIBRARY SSL_CLIENT_S_DN_OU SSL_SERVER_S_DN_OU
-SSL_VERSION_INTERFACE SSL_CLIENT_S_DN_CN SSL_SERVER_S_DN_CN
- SSL_CLIENT_S_DN_T SSL_SERVER_S_DN_T
- SSL_CLIENT_S_DN_I SSL_SERVER_S_DN_I
- SSL_CLIENT_S_DN_G SSL_SERVER_S_DN_G
- SSL_CLIENT_S_DN_S SSL_SERVER_S_DN_S
- SSL_CLIENT_S_DN_D SSL_SERVER_S_DN_D
- SSL_CLIENT_S_DN_UID SSL_SERVER_S_DN_UID
- SSL_CLIENT_S_DN_Email SSL_SERVER_S_DN_Email
- SSL_CLIENT_I_DN SSL_SERVER_I_DN
- SSL_CLIENT_I_DN_C SSL_SERVER_I_DN_C
- SSL_CLIENT_I_DN_ST SSL_SERVER_I_DN_ST
- SSL_CLIENT_I_DN_L SSL_SERVER_I_DN_L
- SSL_CLIENT_I_DN_O SSL_SERVER_I_DN_O
- SSL_CLIENT_I_DN_OU SSL_SERVER_I_DN_OU
- SSL_CLIENT_I_DN_CN SSL_SERVER_I_DN_CN
- SSL_CLIENT_I_DN_T SSL_SERVER_I_DN_T
- SSL_CLIENT_I_DN_I SSL_SERVER_I_DN_I
- SSL_CLIENT_I_DN_G SSL_SERVER_I_DN_G
- SSL_CLIENT_I_DN_S SSL_SERVER_I_DN_S
- SSL_CLIENT_I_DN_D SSL_SERVER_I_DN_D
- SSL_CLIENT_I_DN_UID SSL_SERVER_I_DN_UID
- SSL_CLIENT_I_DN_Email SSL_SERVER_I_DN_Email
- SSL_CLIENT_A_SIG SSL_SERVER_A_SIG
- SSL_CLIENT_A_KEY SSL_SERVER_A_KEY
- SSL_CLIENT_CERT SSL_SERVER_CERT
- SSL_CLIENT_CERT_CHAIN_n
- SSL_CLIENT_VERIFY
-
+Notes on the PeerExtList function
+
+
+
+
+"nsComment",
+or a numeric OID, such as "1.2.3.4.5.6".SSL_SERVER_S_DN_OU_0 and
SSL_CLIENT_V_REMAIN is only available in version 2.1
and later.HTTP_USER_AGENT PATH_INFO AUTH_TYPE
+HTTP_REFERER QUERY_STRING SERVER_SOFTWARE
+HTTP_COOKIE REMOTE_HOST API_VERSION
+HTTP_FORWARDED REMOTE_IDENT TIME_YEAR
+HTTP_HOST IS_SUBREQ TIME_MON
+HTTP_PROXY_CONNECTION DOCUMENT_ROOT TIME_DAY
+HTTP_ACCEPT SERVER_ADMIN TIME_HOUR
+THE_REQUEST SERVER_NAME TIME_MIN
+REQUEST_FILENAME SERVER_PORT TIME_SEC
+REQUEST_METHOD SERVER_PROTOCOL TIME_WDAY
+REQUEST_SCHEME REMOTE_ADDR TIME
+REQUEST_URI REMOTE_USER
+
+
ENV:variablenameHTTP:headernamevarname any variable from Table 3 can be used. Finally for
+varname any of the variables described in Environment Variables can be used. For
funcname the following functions are available:
file(filename)
@@ -1224,76 +1253,45 @@ at runtime only the machine representation is executed. For Per-Directory
context this is different: here expression has to be parsed and
immediately executed for every request.
SSLRequire ( %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
+ and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
+ and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
+ and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
+ and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20 ) \
+ or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/
The PeerExtList(object id) function expects to find
-zero or more instances of the X.509 Certificate Extension (as identified by
-the given object id) in the client certificate, and compares the
-left-hand side string against the value of any matching attribute value. Every
-extension with the specified object id is checked, until a match is found.
-
Standard CGI/1.0 and Apache variables:
--HTTP_USER_AGENT PATH_INFO AUTH_TYPE -HTTP_REFERER QUERY_STRING SERVER_SOFTWARE -HTTP_COOKIE REMOTE_HOST API_VERSION -HTTP_FORWARDED REMOTE_IDENT TIME_YEAR -HTTP_HOST IS_SUBREQ TIME_MON -HTTP_PROXY_CONNECTION DOCUMENT_ROOT TIME_DAY -HTTP_ACCEPT SERVER_ADMIN TIME_HOUR -HTTP:headername SERVER_NAME TIME_MIN -THE_REQUEST SERVER_PORT TIME_SEC -REQUEST_METHOD SERVER_PROTOCOL TIME_WDAY -REQUEST_SCHEME REMOTE_ADDR TIME -REQUEST_URI REMOTE_USER ENV:variablename -REQUEST_FILENAME --
SSL-related variables:
--HTTPS SSL_CLIENT_M_VERSION SSL_SERVER_M_VERSION - SSL_CLIENT_M_SERIAL SSL_SERVER_M_SERIAL -SSL_PROTOCOL SSL_CLIENT_V_START SSL_SERVER_V_START -SSL_SESSION_ID SSL_CLIENT_V_END SSL_SERVER_V_END -SSL_SESSION_RESUMED SSL_CLIENT_S_DN SSL_SERVER_S_DN -SSL_CIPHER SSL_CLIENT_S_DN_C SSL_SERVER_S_DN_C -SSL_CIPHER_EXPORT SSL_CLIENT_S_DN_ST SSL_SERVER_S_DN_ST -SSL_CIPHER_ALGKEYSIZE SSL_CLIENT_S_DN_L SSL_SERVER_S_DN_L -SSL_CIPHER_USEKEYSIZE SSL_CLIENT_S_DN_O SSL_SERVER_S_DN_O -SSL_VERSION_LIBRARY SSL_CLIENT_S_DN_OU SSL_SERVER_S_DN_OU -SSL_VERSION_INTERFACE SSL_CLIENT_S_DN_CN SSL_SERVER_S_DN_CN - SSL_CLIENT_S_DN_T SSL_SERVER_S_DN_T - SSL_CLIENT_S_DN_I SSL_SERVER_S_DN_I - SSL_CLIENT_S_DN_G SSL_SERVER_S_DN_G - SSL_CLIENT_S_DN_S SSL_SERVER_S_DN_S - SSL_CLIENT_S_DN_D SSL_SERVER_S_DN_D - SSL_CLIENT_S_DN_UID SSL_SERVER_S_DN_UID - SSL_CLIENT_S_DN_Email SSL_SERVER_S_DN_Email - SSL_CLIENT_I_DN SSL_SERVER_I_DN - SSL_CLIENT_I_DN_C SSL_SERVER_I_DN_C - SSL_CLIENT_I_DN_ST SSL_SERVER_I_DN_ST - SSL_CLIENT_I_DN_L SSL_SERVER_I_DN_L - SSL_CLIENT_I_DN_O SSL_SERVER_I_DN_O - SSL_CLIENT_I_DN_OU SSL_SERVER_I_DN_OU - SSL_CLIENT_I_DN_CN SSL_SERVER_I_DN_CN - SSL_CLIENT_I_DN_T SSL_SERVER_I_DN_T - SSL_CLIENT_I_DN_I SSL_SERVER_I_DN_I - SSL_CLIENT_I_DN_G SSL_SERVER_I_DN_G - SSL_CLIENT_I_DN_S SSL_SERVER_I_DN_S - SSL_CLIENT_I_DN_D SSL_SERVER_I_DN_D - SSL_CLIENT_I_DN_UID SSL_SERVER_I_DN_UID - SSL_CLIENT_I_DN_Email SSL_SERVER_I_DN_Email - SSL_CLIENT_A_SIG SSL_SERVER_A_SIG - SSL_CLIENT_A_KEY SSL_SERVER_A_KEY - SSL_CLIENT_CERT SSL_SERVER_CERT - SSL_CLIENT_CERT_CHAIN_n - SSL_CLIENT_VERIFY -+
The PeerExtList(object-ID) function expects
+to find zero or more instances of the X.509 certificate extension
+identified by the given object ID in the client certificate.
+The expression evaluates to true if the left-hand side string matches
+exactly against the value of an extension identified with this OID.
+(If multiple extensions with the same OID are present, at least one
+extension must match).
The string used for the object-ID can be either be a descriptive
+name as recognized by the SSL library, such as "nsComment",
+or a numeric OID, such as "1.2.3.4.5.6".
Expressions with types known to the SSL library are rendered to +a string before comparison. For an extension with a type not +recognized by the SSL library, mod_ssl will parse the value if it is +one of the primitive ASN.1 type UTF8String, IA5String, VisibleString, +or BMPString. For an extension of one of these types, the string +value will be converted to UTF-8 if necessary, then compared against +the left-hand-side expression.