<div dir="ltr"><div class="gmail_extra"> <div class="gmail_quote">On Wed, Feb 15, 2017 at 6:31 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><div class="gmail-HOEnZb"><div class="gmail-h5">Andrei Ivanov wrote: > Hi, > I'm trying to access the SSL_CLIENT_SAN_IPAddr variables that mod_nss > should expose, from a Lua authorization script. > The problem is that it doesn't seem to work :-( > > Following a suggestion from the users group, I used some RewriteRule to > expose variables and some are visible, but the client SAN IP addresses > are not: > > LuaScope thread > LuaAuthzProvider remote_ip_in_client_san > /etc/httpd/authz/authz_check_remote_ip_in_client_san.lua > authz_check_remote_ip_in_client_san > RewriteEngine On > RewriteRule .* - [E=sanip:%{SSL:SSL_CLIENT_SAN_IPAddr_0}] > RewriteRule .* - [E=c_verify:%{SSL:SSL_CLIENT_VERIFY}] > RewriteRule .* - [E=c_s_dn:%{SSL:SSL_CLIENT_S_DN}] > RewriteRule .* - [E=ssl_ver_if:%{SSL:SSL_VERSION_INTERFACE}] > RewriteRule .* - [E=ssl_ver_lib:%{SSL:SSL_VERSION_LIBRARY}] > <Location /> > Require remote_ip_in_client_san > #NSSRequire %{REMOTE_ADDR} in %{SSL_CLIENT_SAN_IPaddr} > #Require expr "%{REMOTE_ADDR} in %{SSL_CLIENT_SAN_IPaddr}" > </Location> > > The generated log: > [Wed Feb 15 13:14:07.653866 2017] ssl ver if: mod_nss/1.0.14 > [Wed Feb 15 13:14:07.653871 2017] ssl ver lib: NSS/3.21 Basic ECC > [Wed Feb 15 13:14:07.653876 2017] client verify: SUCCESS > [Wed Feb 15 13:14:07.653881 2017] client DN: > CN=client-with-subjectAltName-with-IPs > [Wed Feb 15 13:14:07.653886 2017] sanip: > > Initially I hoped that mod_nss would expose all the SAN IP addresses as > an array (SSL_CLIENT_SAN_IPAddr), but now I've read that it actually > should create a variable for each, with a suffix > (SSL_CLIENT_SAN_IPAddr_0), but that doesn't seem to be available either. > > What am I doing wrong? > Please help. </div></div>Are the variables case-sensitive with rewrite rules? IF so you have a typo, IPAddr vs IPaddr. As far as I can tell the variable should be available. rob </blockquote></div> <div>I've also tried with SSL_CLIENT_SAN_IPaddr_0, as the source code seems to be using it (as oposed to the documentation), still no luck :-( </div>I've checked with SSL_CLIENT_SAN_Email_0 and that works, so it might be an IP address type issue (?)</div></div>