[PATCH] Proxy SSL Verify

[W. Andrew Loe III]

This patch allows you to force OpenSSL to validate the certificate of
the server the http_proxy module is communicating with. Originally
built against 0.7.x branch, I will forward port when I can. I would
appreciate if anyone else has input on how to do this more elegantly,
my skills are rudimentary at best.


diff -uNr ../nginx-0.7.67/src/event/ngx_event_openssl.c
src/event/ngx_event_openssl.c
--- ../nginx-0.7.67/src/event/ngx_event_openssl.c	2010-06-07
04:55:20.000000000 -0700
+++ src/event/ngx_event_openssl.c	2011-09-13 14:17:05.000000000 -0700
@@ -157,6 +157,12 @@
     SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_CHALLENGE_BUG);
     SSL_CTX_set_options(ssl->ctx, SSL_OP_NETSCAPE_REUSE_CIPHER_CHANGE_BUG);

+    /* verification options */
+
+    SSL_CTX_load_verify_locations(ssl->ctx, (const char
*)ssl->ca_certificate.data, NULL);
+    SSL_CTX_set_verify(ssl->ctx, ssl->verify, NULL);
+    SSL_CTX_set_verify_depth(ssl->ctx, ssl->verify_depth);
+
     /* server side options */

     SSL_CTX_set_options(ssl->ctx, SSL_OP_SSLREF2_REUSE_CERT_TYPE_BUG);
diff -uNr ../nginx-0.7.67/src/event/ngx_event_openssl.h
src/event/ngx_event_openssl.h
--- ../nginx-0.7.67/src/event/ngx_event_openssl.h	2010-06-07
03:09:14.000000000 -0700
+++ src/event/ngx_event_openssl.h	2011-09-13 14:17:05.000000000 -0700
@@ -27,6 +27,9 @@
 typedef struct {
     SSL_CTX                    *ctx;
     ngx_log_t                  *log;
+    ngx_uint_t                  verify;
+    ngx_uint_t                  verify_depth;
+    ngx_str_t                   ca_certificate;
 } ngx_ssl_t;


diff -uNr ../nginx-0.7.67/src/http/modules/ngx_http_proxy_module.c
src/http/modules/ngx_http_proxy_module.c
--- ../nginx-0.7.67/src/http/modules/ngx_http_proxy_module.c	2010-06-07
05:23:23.000000000 -0700
+++ src/http/modules/ngx_http_proxy_module.c	2011-09-13 14:17:05.000000000 -0700
@@ -466,6 +466,27 @@
       offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_session_reuse),
       NULL },

+      { ngx_string("proxy_ssl_verify"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_num_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_verify),
+      NULL },
+
+      { ngx_string("proxy_ssl_verify_depth"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_num_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_verify_depth),
+      NULL },
+
+      { ngx_string("proxy_ssl_ca_certificate"),
+      NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
+      ngx_conf_set_str_slot,
+      NGX_HTTP_LOC_CONF_OFFSET,
+      offsetof(ngx_http_proxy_loc_conf_t, upstream.ssl_ca_certificate),
+      NULL },
+
 #endif

       ngx_null_command
@@ -1950,6 +1971,8 @@
     conf->upstream.intercept_errors = NGX_CONF_UNSET;
 #if (NGX_HTTP_SSL)
     conf->upstream.ssl_session_reuse = NGX_CONF_UNSET;
+    conf->upstream.ssl_verify = NGX_CONF_UNSET_UINT;
+    conf->upstream.ssl_verify_depth = NGX_CONF_UNSET_UINT;
 #endif

     /* "proxy_cyclic_temp_file" is disabled */
@@ -2196,6 +2219,22 @@
 #if (NGX_HTTP_SSL)
     ngx_conf_merge_value(conf->upstream.ssl_session_reuse,
                               prev->upstream.ssl_session_reuse, 1);
+    ngx_conf_merge_uint_value(conf->upstream.ssl_verify,
+                              prev->upstream.ssl_verify, 0);
+    ngx_conf_merge_uint_value(conf->upstream.ssl_verify_depth,
+                              prev->upstream.ssl_verify_depth, 1);
+    ngx_conf_merge_str_value(conf->upstream.ssl_ca_certificate,
+                              prev->upstream.ssl_ca_certificate, "");
+
+    if (conf->upstream.ssl_verify) {
+      if (conf->upstream.ssl_ca_certificate.len == 0) {
+        ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+            "no \"proxy_ssl_ca_certificate\" is defined for "
+            "the \"proxy_ssl_verify\" directive");
+
+        return NGX_CONF_ERROR;
+      }
+    }
 #endif

     ngx_conf_merge_value(conf->redirect, prev->redirect, 1);
@@ -3011,6 +3050,12 @@

     plcf->upstream.ssl->log = cf->log;

+    plcf->upstream.ssl->ca_certificate.len =
plcf->upstream.ssl_ca_certificate.len;
+    plcf->upstream.ssl->ca_certificate.data =
plcf->upstream.ssl_ca_certificate.data;
+
+    plcf->upstream.ssl->verify = plcf->upstream.ssl_verify;
+    plcf->upstream.ssl->verify_depth = plcf->upstream.ssl_verify_depth;
+
     if (ngx_ssl_create(plcf->upstream.ssl,
                        NGX_SSL_SSLv2|NGX_SSL_SSLv3|NGX_SSL_TLSv1, NULL)
         != NGX_OK)
diff -uNr ../nginx-0.7.67/src/http/ngx_http_upstream.h
src/http/ngx_http_upstream.h
--- ../nginx-0.7.67/src/http/ngx_http_upstream.h	2010-06-07
05:23:23.000000000 -0700
+++ src/http/ngx_http_upstream.h	2011-09-13 14:17:05.000000000 -0700
@@ -173,6 +173,9 @@
 #if (NGX_HTTP_SSL)
     ngx_ssl_t                       *ssl;
     ngx_flag_t                       ssl_session_reuse;
+    ngx_uint_t                       ssl_verify;
+    ngx_uint_t                       ssl_verify_depth;
+    ngx_str_t                        ssl_ca_certificate;
 #endif

 } ngx_http_upstream_conf_t;
-------------- next part --------------
A non-text attachment was scrubbed...
Name: proxy_ssl_verify.patch
Type: application/octet-stream
Size: 4878 bytes
Desc: not available
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20110913/60e109b4/attachment.obj>