"Faking HTTP Basic Auth header: \"Authorization: %s\"", b1);
"Faking HTTP Basic Auth header: \"Authorization: %s\"", cpAL);
int ssl_hook_Auth(request_rec *r){    SSLSrvConfigRec *sc = mySrvConfig(r->server);    SSLDirConfigRec *dc = myDirConfig(r);    char b1[MAX_STRING_LEN], b2[MAX_STRING_LEN];    char *clientdn;    const char *cpAL;    const char *cpUN;    const char *cpPW;    /*     * Additionally forbid access (again)     * when strict require option is used.     */    if (   (dc->nOptions & SSL_OPT_STRICTREQUIRE)        && (ap_table_get(r->notes, "ssl-access-forbidden") != NULL))        return FORBIDDEN;    /*     * Make sure the user is not able to fake the client certificate     * based authentication by just entering an X.509 Subject DN     * ("/XX=YYY/XX=YYY/..") as the username and "password" as the     * password.     */    if (   ap_is_initial_req(r)        && (cpAL = ap_table_get(r->headers_in, "Authorization")) != NULL) {        if (strcEQ(ap_getword(r->pool, &cpAL, ' '), "Basic")) {            while (*cpAL == ' ' || *cpAL == '\t')                cpAL++;            cpAL = ap_pbase64decode(r->pool, cpAL);            cpUN = ap_getword_nulls(r->pool, &cpAL, ':');            cpPW = cpAL;            if (cpUN[0] == '/' && strEQ(cpPW, "password")) {                ssl_log(r->server, SSL_LOG_WARN,                         "real Basic Authentication with DN \"%s\" and fake password attempted", cpUN);                return FORBIDDEN;            }        }    }    /*     * We decline operation in various situations...     */    if (!sc->bEnabled)        return DECLINED;    if (ap_ctx_get(r->connection->client->ctx, "ssl") == NULL)        return DECLINED;    if (!(dc->nOptions & SSL_OPT_FAKEBASICAUTH))        return DECLINED;    if (r->connection->user)        return DECLINED;    if ((clientdn = (char *)ap_ctx_get(r->connection->client->ctx, "ssl::client::dn")) == NULL)        return DECLINED;    /*     * Fake a password - which one would be immaterial, as, it seems, an empty     * password in the users file would match ALL incoming passwords, if only     * we were using the standard crypt library routine. Unfortunately, OpenSSL     * "fixes" a "bug" in crypt and thus prevents blank passwords from     * working.  (IMHO what they really fix is a bug in the users of the code     * - failing to program correctly for shadow passwords).  We need,     * therefore, to provide a password. This password can be matched by     * adding the string "xxj31ZMTZzkVA" as the password in the user file.     * This is just the crypted variant of the word "password" ;-)     */    ap_snprintf(b1, sizeof(b1), "%s:password", clientdn);    ssl_util_uuencode(b2, b1, FALSE);    ap_snprintf(b1, sizeof(b1), "Basic %s", b2);    ap_table_set(r->headers_in, "Authorization", b1);    ssl_log(r->server, SSL_LOG_INFO,            "Faking HTTP Basic Auth header: \"Authorization: %s\"", b1);    return DECLINED;}