<div dir="ltr"><br>On Wed, Aug 28, 2013 at 9:54 AM, Maxim Dounin <<a href="mailto:mdounin@mdounin.ru">mdounin@mdounin.ru</a>> wrote:<br>><br>> Hello!<div><br></div><div>Hi!</div><div><br>><br>> On Wed, Aug 28, 2013 at 09:20:46AM +0100, Phil Parker wrote:<br>
><br>> > This has been discussed in detail previously:<br>> ><br>> > <a href="http://trac.nginx.org/nginx/ticket/13">http://trac.nginx.org/nginx/ticket/13</a><br>> > <a href="http://mailman.nginx.org/pipermail/nginx-devel/2011-September/001182.html">http://mailman.nginx.org/pipermail/nginx-devel/2011-September/001182.html</a><br>
> ><br>> > I have created a patch that I'm using locally and would like to contribute<br>> > but am a first-time contributor so looking for advice.<br>><br>> Given the fact that Aviram Cohen's patch for the same ticket is<br>
> already in the review process, I would suggest you to join<br>> review/testing instead.<br><br>Thanks, I missed that in all my searches. <div><br></div><div>It might be worth adding a comment to the trac ticket and the previous (dead, I think) patch thread I found above so people can "follow the breadcrumbs"?<br>
<br>> See this thread for details:<br>> <a href="http://mailman.nginx.org/pipermail/nginx-devel/2013-August/004085.html">http://mailman.nginx.org/pipermail/nginx-devel/2013-August/004085.html</a><br>><div><br></div>
<div>I've downloaded this and managed to patch/compile on:</div><div><br></div><div><div>nginx version: nginx/1.4.2</div></div><div>Linux 3.8.0-25-generic #37-Ubuntu SMP Thu Jun 6 20:47:07 UTC 2013 x86_64 GNU/Linux<br>
</div><div><br></div><div>I specified proxy_ssl_verify and proxy_ssl_trusted_certificate (I tried this with both specifying a single cert, which worked with my previous patch, and a combined cert via 'openssl x509 -in cert1.pem -text >> CAfile.pem') but got the following error when trying to proxy:</div>
<div><br></div><div>[error] 14716#0: *1 upstream sslcertificate validation failed while SSL handshaking to upstream<br></div><div><br></div><div>This message doesn't match the one in the patch (which is just "upstream sslcertificate validation failed" but a search led me to <a href="http://serverfault.com/questions/436737/forcing-a-particular-ssl-protocol-for-an-nginx-proxying-server">http://serverfault.com/questions/436737/forcing-a-particular-ssl-protocol-for-an-nginx-proxying-server</a>. </div>
<div>In my case downgrading openssl to 1.0.0 didn't seem to change anything. I'll keep investigating but would be useful to see if anyone has seen this before or knows what the cause might be.</div><div><br></div>
<div>One additional point is it looks from the patch like if you don't specify 'proxy_ssl_verify_depth' it defaults to 1 but the Open SSL documentation states it defaults to 9 <a href="http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html#NOTES">http://www.openssl.org/docs/ssl/SSL_CTX_set_verify.html#NOTES</a>. </div>
<div><br></div><div>I'd suggest if it's not specified in an nginx directive then the default should be that of open ssl (the Principle of Least Astonishment applies....).</div><div><br></div><div><br>> > The way I've implemented it supports two (mutually exclusive) new<br>
> > directives on a location. e.g.<br>> ><br>> > location / {<br>> > proxy_ssl_peer_certificate_path "/tmp/sslcerts";<br>> > #proxy_ssl_peer_certificate_file "/tmp/sslcerts/cert.pem";<br>
> > proxy_pass ....<br>> > }<br>> ><br>> > These are passed through to SSL_CTX_load_verify_locations (<br>> > <a href="http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html">http://www.openssl.org/docs/ssl/SSL_CTX_load_verify_locations.html</a>)<br>
><br>> Just a side note: we don't provide "_path" variants for other<br>> certificate verification directives, so it's unlikely it will be<br>> accepted for a proxy peer verification.<br>><br>
> > The main advice I'm looking for:<br>> ><br>> > 1) Is this implemented in a way that is useful for others?<br>> > 2) Should I be writing tests/test driving? If so, how?<br>><br>> Writing tests may make sense (though not required), test suite is<br>
> available at <a href="http://hg.nginx.org/nginx-tests">http://hg.nginx.org/nginx-tests</a>.<br>><br>> > 3) Anything in the patch (below) that needs to be changed (implementation<br>> > or style)?<br>> > 4) How best to submit the patch (I've currently made it against 1.4.2 and<br>
> > just created a patch file, not currently a Mercurial user but can check-out<br>> > if necessary)?<br>><br>> Basic recommendations can be found here:<br>><br>> <a href="http://nginx.org/en/docs/contributing_changes.html">http://nginx.org/en/docs/contributing_changes.html</a><br>
><br>> [...]<br>><br>> --<br>> Maxim Dounin<br>> <a href="http://nginx.org/en/donation.html">http://nginx.org/en/donation.html</a><br>><br>> _______________________________________________<br>> nginx-devel mailing list<br>
> <a href="mailto:nginx-devel@nginx.org">nginx-devel@nginx.org</a><br>> <a href="http://mailman.nginx.org/mailman/listinfo/nginx-devel">http://mailman.nginx.org/mailman/listinfo/nginx-devel</a></div><div><br></div><div>
<br></div><div>P.<br><br></div></div></div></div>