Mercurial > hg > nginx
changeset 2994:f33c48457d0c
*) $ssl_client_verify
*) "ssl_verify_client ask" was changed to "ssl_verify_client optional"
author | Igor Sysoev <igor@sysoev.ru> |
---|---|
date | Wed, 22 Jul 2009 17:41:42 +0000 |
parents | f592d466bbda |
children | cc07d164f0dc |
files | src/event/ngx_event_openssl.c src/event/ngx_event_openssl.h src/http/modules/ngx_http_ssl_module.c src/http/ngx_http_request.c |
diffstat | 4 files changed, 49 insertions(+), 13 deletions(-) [+] |
line wrap: on
line diff
--- a/src/event/ngx_event_openssl.c Wed Jul 22 13:06:27 2009 +0000 +++ b/src/event/ngx_event_openssl.c Wed Jul 22 17:41:42 2009 +0000 @@ -2108,6 +2108,35 @@ } +ngx_int_t +ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s) +{ + X509 *cert; + + if (SSL_get_verify_result(c->ssl->connection) != X509_V_OK) { + s->len = sizeof("FAILED") - 1; + s->data = (u_char *) "FAILED"; + + return NGX_OK; + } + + cert = SSL_get_peer_certificate(c->ssl->connection); + + if (cert) { + s->len = sizeof("SUCCESS") - 1; + s->data = (u_char *) "SUCCESS"; + + } else { + s->len = sizeof("NONE") - 1; + s->data = (u_char *) "NONE"; + } + + X509_free(cert); + + return NGX_OK; +} + + static void * ngx_openssl_create_conf(ngx_cycle_t *cycle) {
--- a/src/event/ngx_event_openssl.h Wed Jul 22 13:06:27 2009 +0000 +++ b/src/event/ngx_event_openssl.h Wed Jul 22 17:41:42 2009 +0000 @@ -131,6 +131,8 @@ ngx_str_t *s); ngx_int_t ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s); +ngx_int_t ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, + ngx_str_t *s); ngx_int_t ngx_ssl_handshake(ngx_connection_t *c);
--- a/src/http/modules/ngx_http_ssl_module.c Wed Jul 22 13:06:27 2009 +0000 +++ b/src/http/modules/ngx_http_ssl_module.c Wed Jul 22 17:41:42 2009 +0000 @@ -52,7 +52,7 @@ static ngx_conf_enum_t ngx_http_ssl_verify[] = { { ngx_string("off"), 0 }, { ngx_string("on"), 1 }, - { ngx_string("ask"), 2 }, + { ngx_string("optional"), 2 }, { ngx_null_string, 0 } }; @@ -206,6 +206,9 @@ { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable, (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 }, + { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable, + (uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 }, + { ngx_null_string, NULL, NULL, 0, 0, 0 } };
--- a/src/http/ngx_http_request.c Wed Jul 22 13:06:27 2009 +0000 +++ b/src/http/ngx_http_request.c Wed Jul 22 17:41:42 2009 +0000 @@ -1524,7 +1524,7 @@ sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module); - if (sscf->verify == 1) { + if (sscf->verify) { rc = SSL_get_verify_result(c->ssl->connection); if (rc != X509_V_OK) { @@ -1539,20 +1539,22 @@ return; } - cert = SSL_get_peer_certificate(c->ssl->connection); - - if (cert == NULL) { - ngx_log_error(NGX_LOG_INFO, c->log, 0, - "client sent no required SSL certificate"); - - ngx_ssl_remove_cached_session(sscf->ssl.ctx, + if (sscf->verify == 1) { + cert = SSL_get_peer_certificate(c->ssl->connection); + + if (cert == NULL) { + ngx_log_error(NGX_LOG_INFO, c->log, 0, + "client sent no required SSL certificate"); + + ngx_ssl_remove_cached_session(sscf->ssl.ctx, (SSL_get0_session(c->ssl->connection))); - ngx_http_finalize_request(r, NGX_HTTPS_NO_CERT); - return; + ngx_http_finalize_request(r, NGX_HTTPS_NO_CERT); + return; + } + + X509_free(cert); } - - X509_free(cert); } }