SSLRequire

Name

SSLRequire

Synopsis

SSLRequire expression
directory, .htaccess
Override: AuthConfig
Apache v2 only

This directive invokes a test that has to be fulfilled to allow access. It is a powerful directive because the test is an arbitrarily complex Boolean expression containing any number of access checks.

The expression must match the following syntax (given as a BNF grammar notation — see http://www.cs.man.ac.uk/~pjj/bnf/bnf.html):

expr     ::= "true" | "false"
           | "!" expr
           | expr "&&" expr
           | expr "||" expr
           | "(" expr ")"
           | comp

comp     ::= word "==" word | word "eq" word
           | word "!=" word | word "ne" word
           | word "<"  word | word "lt" word
           | word "<=" word | word "le" word
           | word ">"  word | word "gt" word
           | word ">=" word | word "ge" word
           | word "in" "{" wordlist "}"
           | word "=~" regex
           | word "!~" regex

wordlist ::= word
           | wordlist "," word

word     ::= digit
           | cstring
           | variable
           | function

digit    ::= [0-9]+
cstring  ::= "..."
variable ::= "%{" varname "}"
function ::= funcname "(" funcargs ")"

while for varname any of the following standard CGI and Apache variables can be used:

`HTTP_USER_AGENT`	`PATH_INFO`	`AUTH_TYPE`
`HTTP_REFERER`	`QUERY_STRING`	`SERVER_SOFTWARE`
`HTTP_COOKIE`	`REMOTE_HOST`	`API_VERSION`
`HTTP_FORWARDED`	`REMOTE_IDENT`	`TIME_YEAR`
`HTTP_HOST`	`IS_SUBREQ`	`TIME_MON`
`HTTP_PROXY_CONNECTION`	`DOCUMENT_ROOT`	`TIME_DAY`
`HTTP_ACCEPT`	`SERVER_ADMIN`	`TIME_HOUR`
`HTTP:` `headername`	`SERVER_NAME`	`TIME_MIN`
`THE_REQUEST`	`SERVER_PORT`	`TIME_SEC`
`REQUEST_METHOD`	`SERVER_PROTOCOL`	`TIME_WDAY`
`REQUEST_SCHEME`	`REMOTE_ADDR`	`TIME`
`REQUEST_URI`	`REMOTE_USER`	`ENV:` `variablename`
`REQUEST_FILENAME`

as well as any of the following SSL-related variables:

`HTTPS`	`SSL_CLIENT_M_VERSION`	`SSL_SERVER_M_VERSION`
`SSL_CLIENT_M_SERIAL`	`SSL_SERVER_M_SERIAL`	`SSL_PROTOCOL`
`SSL_CLIENT_V_START`	`SSL_SERVER_V_START`	`SSL_SESSION_ID`
`SSL_CLIENT_V_END`	`SSL_SERVER_V_END`	`SSL_CIPHER`
`SSL_CLIENT_S_DN`	`SSL_SERVER_S_DN`	`SSL_CIPHER_EXPORT`
`SSL_CLIENT_S_DN_C`	`SSL_SERVER_S_DN_C`	`SSL_CIPHER_ALGKEYSIZE`
`SSL_CLIENT_S_DN_ST`	`SSL_SERVER_S_DN_ST`	`SSL_CIPHER_USEKEYSIZE`
`SSL_CLIENT_S_DN_L`	`SSL_SERVER_S_DN_L`	`SSL_VERSION_LIBRARY`
`SSL_CLIENT_S_DN_O`	`SSL_SERVER_S_DN_O`	`SSL_VERSION_INTERFACE`
`SSL_CLIENT_S_DN_OU`	`SSL_SERVER_S_DN_OU`	`SSL_CLIENT_S_DN_CN`
`SSL_SERVER_S_DN_CN`	`SSL_CLIENT_S_DN_T`	`SSL_SERVER_S_DN_T`
`SSL_CLIENT_S_DN_I`	`SSL_SERVER_S_DN_I`	`SSL_CLIENT_S_DN_G`
`SSL_SERVER_S_DN_G`	`SSL_CLIENT_S_DN_S`	`SSL_SERVER_S_DN_S`
`SSL_CLIENT_S_DN_D`	`SSL_SERVER_S_DN_D`	`SSL_CLIENT_S_DN_UID`
`SSL_SERVER_S_DN_UID`

Finally, for funcname the following functions are available:

file(filename)

This function takes one string argument and expands to the contents of the file. This is especially useful for matching the contents against a regular expression

Notice that expression is first parsed into an internal machine representation and then evaluated in a second step. In global and per-server class contexts, expression is parsed at startup time. At runtime only the machine representation is executed. In the per-directory context expression is parsed and executed at each request.

Example

SSLRequire (    %{SSL_CIPHER} !~ m/^(EXP|NULL)-/ \
            and %{SSL_CLIENT_S_DN_O} eq "Snake Oil, Ltd." \
            and %{SSL_CLIENT_S_DN_OU} in {"Staff", "CA", "Dev"} \
            and %{TIME_WDAY} >= 1 and %{TIME_WDAY} <= 5 \
            and %{TIME_HOUR} >= 8 and %{TIME_HOUR} <= 20       ) \
           or %{REMOTE_ADDR} =~ m/^192\.76\.162\.[0-9]+$/

In plain English, we require the cipher not to be export or null, the organization to be “Snake Oil, Ltd.,” the organizational unit to be one of “Staff,” “CA,” or “DEV,” the date and time to be between Monday and Friday and between 8a.m. and 6p.m., or for the client to come from 192.76.162.