Ticket #13: proxy_ssl_verify-1.1.3.patch

File proxy_ssl_verify-1.1.3.patch, 7.8 KB (added by waloeiii.myopenid.com, 15 years ago)

  • src/event/ngx_event_openssl.c 

    diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 259b1d8..05b49dd 100644
    a b ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,  
    216216    return NGX_OK;
    217217}
    218218
    219 
    220219ngx_int_t
    221 ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
     220ngx_ssl_set_verify_options(ngx_ssl_t *ssl, ngx_str_t *cert,
    222221    ngx_int_t depth)
    223222{
    224     STACK_OF(X509_NAME)  *list;
    225 
    226223    SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_http_ssl_verify_callback);
    227224
    228225    SSL_CTX_set_verify_depth(ssl->ctx, depth);
    … … ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,  
    231228        return NGX_OK;
    232229    }
    233230
    234     if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
    235         return NGX_ERROR;
    236     }
    237 
    238231    if (SSL_CTX_load_verify_locations(ssl->ctx, (char *) cert->data, NULL)
    239232        == 0)
    240233    {
    … … ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,  
    244237        return NGX_ERROR;
    245238    }
    246239
     240    return NGX_OK;
     241}
     242
     243ngx_int_t
     244ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
     245    ngx_int_t depth)
     246{
     247    STACK_OF(X509_NAME)  *list;
     248
     249    if (ngx_ssl_set_verify_options(ssl, cert, depth) != NGX_OK) {
     250        return NGX_ERROR;
     251    }
     252
     253    if (ngx_conf_full_name(cf->cycle, cert, 1) != NGX_OK) {
     254        return NGX_ERROR;
     255    }
     256
    247257    list = SSL_load_client_CA_file((char *) cert->data);
    248258
    249259    if (list == NULL) {
    … … ngx_ssl_crl(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *crl)  
    313323static int
    314324ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)
    315325{
    316 #if (NGX_DEBUG)
    317     char              *subject, *issuer;
    318     int                err, depth;
    319     X509              *cert;
    320     X509_NAME         *sname, *iname;
    321326    ngx_connection_t  *c;
    322327    ngx_ssl_conn_t    *ssl_conn;
    323328
    … … ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)  
    326331
    327332    c = ngx_ssl_get_connection(ssl_conn);
    328333
     334#if (NGX_DEBUG)
     335    char              *subject, *issuer;
     336    int                err, depth;
     337    X509              *cert;
     338    X509_NAME         *sname, *iname;
     339
    329340    cert = X509_STORE_CTX_get_current_cert(x509_store);
    330341    err = X509_STORE_CTX_get_error(x509_store);
    331342    depth = X509_STORE_CTX_get_error_depth(x509_store);
    … … ngx_http_ssl_verify_callback(int ok, X509_STORE_CTX *x509_store)  
    350361    }
    351362#endif
    352363
     364    if (ok != 1)
     365    {
     366        ngx_ssl_error(NGX_LOG_EMERG, c->log, 0, "ngx_http_ssl_verify_callback failed");
     367        c->ssl->verification_failed = 1;
     368        return 0;
     369    }
     370
    353371    return 1;
    354372}
    355373
    … … ngx_ssl_handshake(ngx_connection_t *c)  
    575593
    576594    ngx_log_debug1(NGX_LOG_DEBUG_EVENT, c->log, 0, "SSL_do_handshake: %d", n);
    577595
     596    if (c->ssl->verification_failed != NGX_OK)
     597    {
     598      return NGX_ERROR;
     599    }
     600
    578601    if (n == 1) {
    579602
    580603        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {

  • src/event/ngx_event_openssl.h 

    diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 33cab7b..b59baf9 100644
    a b typedef struct {  
    4646    unsigned                    buffer:1;
    4747    unsigned                    no_wait_shutdown:1;
    4848    unsigned                    no_send_shutdown:1;
     49
     50    ngx_int_t                   verification_failed;
    4951} ngx_ssl_connection_t;
    5052
    5153
    … … ngx_int_t ngx_ssl_init(ngx_log_t *log);  
    9698ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data);
    9799ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
    98100    ngx_str_t *cert, ngx_str_t *key);
     101ngx_int_t ngx_ssl_set_verify_options(ngx_ssl_t *ssl, ngx_str_t *cert,
     102    ngx_int_t depth);
    99103ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
    100104    ngx_str_t *cert, ngx_int_t depth);
    101105ngx_int_t ngx_ssl_crl(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *crl);

  • src/http/modules/ngx_http_proxy_module.c 

    diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index 902cfb8..834301e 100644
    a b static ngx_command_t ngx_http_proxy_commands[] = {  
    440440      NGX_HTTP_LOC_CONF_OFFSET,
    441441      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_session_reuse),
    442442      NULL },
     443   
     444    { ngx_string("proxy_ssl_verify_peer"),
     445      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     446      ngx_conf_set_flag_slot,
     447      NGX_HTTP_LOC_CONF_OFFSET,
     448      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_verify_peer),
     449      NULL },
     450
     451    { ngx_string("proxy_ssl_verify_depth"),
     452      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     453      ngx_conf_set_num_slot,
     454      NGX_HTTP_LOC_CONF_OFFSET,
     455      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_verify_depth),
     456      NULL },
    443457
     458    { ngx_string("proxy_ssl_ca_certificate"),
     459      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     460      ngx_conf_set_str_slot,
     461      NGX_HTTP_LOC_CONF_OFFSET,
     462      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_ca_certificate),
     463      NULL },
    444464#endif
    445465
    446466      ngx_null_command
    … … ngx_http_proxy_create_loc_conf(ngx_conf_t *cf)  
    16971717    conf->upstream.intercept_errors = NGX_CONF_UNSET;
    16981718#if (NGX_HTTP_SSL)
    16991719    conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
     1720    conf->upstream.ssl_verify_peer = NGX_CONF_UNSET;
     1721    conf->upstream.ssl_verify_depth = NGX_CONF_UNSET_UINT;
    17001722#endif
    17011723
    17021724    /* "proxy_cyclic_temp_file" is disabled */
    … … ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)  
    19551977#if (NGX_HTTP_SSL)
    19561978    ngx_conf_merge_value(conf->upstream.ssl_session_reuse,
    19571979                              prev->upstream.ssl_session_reuse, 1);
     1980    ngx_conf_merge_value(conf->upstream.ssl_verify_peer,
     1981                              prev->upstream.ssl_verify_peer, 0);
     1982    ngx_conf_merge_uint_value(conf->upstream.ssl_verify_depth,
     1983                              prev->upstream.ssl_verify_depth, 1);
     1984    ngx_conf_merge_str_value(conf->upstream.ssl_ca_certificate,
     1985                              prev->upstream.ssl_ca_certificate, "");
     1986
     1987    if (conf->upstream.ssl_verify_peer) {
     1988      if (conf->upstream.ssl_ca_certificate.len == 0) {
     1989        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
     1990            "no \"proxy_ssl_ca_certificate\" is defined for "
     1991            "the \"proxy_ssl_verify_peer\" directive");
     1992
     1993        return NGX_CONF_ERROR;
     1994      }
     1995    }
    19581996#endif
    19591997
    19601998    ngx_conf_merge_value(conf->redirect, prev->redirect, 1);

  • src/http/ngx_http_upstream.c 

    diff --git a/src/http/ngx_http_upstream.c b/src/http/ngx_http_upstream.c
index 29432dc..474cf0d 100644
    a b ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,  
    12101210{
    12111211    ngx_int_t   rc;
    12121212
     1213    if (ngx_ssl_set_verify_options(u->conf->ssl,
     1214          &u->conf->ssl_ca_certificate, u->conf->ssl_verify_depth)
     1215        != NGX_OK)
     1216    {
     1217      ngx_http_upstream_finalize_request(r, u,
     1218          NGX_HTTP_INTERNAL_SERVER_ERROR);
     1219      return;
     1220    }
     1221
    12131222    if (ngx_ssl_create_connection(u->conf->ssl, c,
    12141223                                  NGX_SSL_BUFFER|NGX_SSL_CLIENT)
    12151224        != NGX_OK)
    … … ngx_http_upstream_init_main_conf(ngx_conf_t *cf, void *conf)  
    45274536
    45284537    return NGX_CONF_OK;
    45294538}
     4539

  • src/http/ngx_http_upstream.h 

    diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
index fa848c0..cc71ba9 100644
    a b typedef struct {  
    177177#if (NGX_HTTP_SSL)
    178178    ngx_ssl_t                       *ssl;
    179179    ngx_flag_t                       ssl_session_reuse;
     180    ngx_flag_t                       ssl_verify_peer;
     181    ngx_uint_t                       ssl_verify_depth;
     182    ngx_str_t                        ssl_ca_certificate;
    180183#endif
    181184
    182185    ngx_str_t                        module;