Ticket #13: proxy_ssl_verify_0.8.55.patch

File proxy_ssl_verify_0.8.55.patch, 4.8 KB (added by waloeiii.myopenid.com, 15 years ago)

  • src/event/ngx_event_openssl.c 

    diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 813f622..b1a9535 100644
    a b ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data)  
    157157    SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
    158158    SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG);
    159159
     160    /* verification options */
     161
     162    SSL_CTX_load_verify_locations(ssl->ctx, (const char *)ssl->ca_certificate.data, NULL);
     163    SSL_CTX_set_verify(ssl->ctx, ssl->verify, NULL);
     164    SSL_CTX_set_verify_depth(ssl->ctx, ssl->verify_depth);
     165
    160166    /* server side options */
    161167
    162168    SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);

  • src/event/ngx_event_openssl.h 

    diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index a8f9d87..264f748 100644
    a b  
    2727typedef struct {
    2828    SSL_CTX                    *ctx;
    2929    ngx_log_t                  *log;
     30    ngx_uint_t                  verify;
     31    ngx_uint_t                  verify_depth;
     32    ngx_str_t                   ca_certificate;
    3033} ngx_ssl_t;
    3134
    3235

  • src/http/modules/ngx_http_proxy_module.c 

    diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c
index 325a1a0..1ecc3f8 100644
    a b static ngx_command_t ngx_http_proxy_commands[] = {  
    441441      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_session_reuse),
    442442      NULL },
    443443
     444      { ngx_string("proxy_ssl_verify"),
     445      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     446      ngx_conf_set_num_slot,
     447      NGX_HTTP_LOC_CONF_OFFSET,
     448      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_verify),
     449      NULL },
     450
     451      { ngx_string("proxy_ssl_verify_depth"),
     452      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     453      ngx_conf_set_num_slot,
     454      NGX_HTTP_LOC_CONF_OFFSET,
     455      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_verify_depth),
     456      NULL },
     457
     458      { ngx_string("proxy_ssl_ca_certificate"),
     459      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
     460      ngx_conf_set_str_slot,
     461      NGX_HTTP_LOC_CONF_OFFSET,
     462      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_ca_certificate),
     463      NULL },
     464
    444465#endif
    445466
    446467      ngx_null_command
    … … ngx_http_proxy_create_loc_conf(ngx_conf_t *cf)  
    16961717    conf->upstream.intercept_errors = NGX_CONF_UNSET;
    16971718#if (NGX_HTTP_SSL)
    16981719    conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
     1720    conf->upstream.ssl_verify = NGX_CONF_UNSET_UINT;
     1721    conf->upstream.ssl_verify_depth = NGX_CONF_UNSET_UINT;
    16991722#endif
    17001723
    17011724    /* "proxy_cyclic_temp_file" is disabled */
    … … ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)  
    19511974#if (NGX_HTTP_SSL)
    19521975    ngx_conf_merge_value(conf->upstream.ssl_session_reuse,
    19531976                              prev->upstream.ssl_session_reuse, 1);
     1977    ngx_conf_merge_uint_value(conf->upstream.ssl_verify,
     1978                              prev->upstream.ssl_verify, 0);
     1979    ngx_conf_merge_uint_value(conf->upstream.ssl_verify_depth,
     1980                              prev->upstream.ssl_verify_depth, 1);
     1981    ngx_conf_merge_str_value(conf->upstream.ssl_ca_certificate,
     1982                              prev->upstream.ssl_ca_certificate, "");
     1983
     1984    if (conf->upstream.ssl_verify) {
     1985      if (conf->upstream.ssl_ca_certificate.len == 0) {
     1986        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
     1987            "no \"proxy_ssl_ca_certificate\" is defined for "
     1988            "the \"proxy_ssl_verify\" directive");
     1989
     1990        return NGX_CONF_ERROR;
     1991      }
     1992    }
    19541993#endif
    19551994
    19561995    ngx_conf_merge_value(conf->redirect, prev->redirect, 1);
    … … ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)  
    27272766
    27282767    plcf->upstream.ssl->log = cf->log;
    27292768
     2769    plcf->upstream.ssl->ca_certificate.len = plcf->upstream.ssl_ca_certificate.len;
     2770    plcf->upstream.ssl->ca_certificate.data = plcf->upstream.ssl_ca_certificate.data;
     2771
     2772    plcf->upstream.ssl->verify = plcf->upstream.ssl_verify;
     2773    plcf->upstream.ssl->verify_depth = plcf->upstream.ssl_verify_depth;
     2774
    27302775    if (ngx_ssl_create(plcf->upstream.ssl,
    27312776                       NGX_SSL_SSLv2|NGX_SSL_SSLv3|NGX_SSL_TLSv1, NULL)
    27322777        != NGX_OK)

  • src/http/ngx_http_upstream.h 

    diff --git a/src/http/ngx_http_upstream.h b/src/http/ngx_http_upstream.h
index ef460a4..924fe5b 100644
    a b typedef struct {  
    177177#if (NGX_HTTP_SSL)
    178178    ngx_ssl_t                       *ssl;
    179179    ngx_flag_t                       ssl_session_reuse;
     180    ngx_uint_t                       ssl_verify;
     181    ngx_uint_t                       ssl_verify_depth;
     182    ngx_str_t                        ssl_ca_certificate;
    180183#endif
    181184
    182185} ngx_http_upstream_conf_t;