mirror/nginx
1
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-12 02:09:04 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

*) $ssl_client_verify

Browse Source 
*) "ssl_verify_client ask" was changed to "ssl_verify_client optional"
This commit is contained in:
Igor Sysoev 2009-07-22 17:41:42 +00:00
parent a4038c8e71
commit 5b4b7c58cc
4 changed files with 47 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

29
src/event/ngx_event_openssl.c
View File

@ -2108,6 +2108,35 @@ ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
}
ngx_int_t
ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
{
X509 *cert;
if (SSL_get_verify_result(c->ssl->connection) != X509_V_OK) {
s->len = sizeof("FAILED") - 1;
s->data = (u_char *) "FAILED";
return NGX_OK;
}
cert = SSL_get_peer_certificate(c->ssl->connection);
if (cert) {
s->len = sizeof("SUCCESS") - 1;
s->data = (u_char *) "SUCCESS";
} else {
s->len = sizeof("NONE") - 1;
s->data = (u_char *) "NONE";
}
X509_free(cert);
return NGX_OK;
}
static void *
ngx_openssl_create_conf(ngx_cycle_t *cycle)
{

2
src/event/ngx_event_openssl.h
View File

@ -131,6 +131,8 @@ ngx_int_t ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool,
ngx_str_t *s);
ngx_int_t ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool,
ngx_str_t *s);
ngx_int_t ngx_ssl_get_client_verify(ngx_connection_t *c, ngx_pool_t *pool,
ngx_str_t *s);
ngx_int_t ngx_ssl_handshake(ngx_connection_t *c);

5
src/http/modules/ngx_http_ssl_module.c
View File

@ -52,7 +52,7 @@ static ngx_conf_bitmask_t ngx_http_ssl_protocols[] = {
static ngx_conf_enum_t ngx_http_ssl_verify[] = {
{ ngx_string("off"), 0 },
{ ngx_string("on"), 1 },
{ ngx_string("ask"), 2 },
{ ngx_string("optional"), 2 },
{ ngx_null_string, 0 }
};
@ -206,6 +206,9 @@ static ngx_http_variable_t ngx_http_ssl_vars[] = {
{ ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable,
(uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 },
{ ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable,
(uintptr_t) ngx_ssl_get_client_verify, NGX_HTTP_VAR_CHANGEABLE, 0 },
{ ngx_null_string, NULL, NULL, 0, 0, 0 }
};

22
src/http/ngx_http_request.c
View File

@ -1524,7 +1524,7 @@ ngx_http_process_request(ngx_http_request_t *r)
sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);
if (sscf->verify == 1) {
if (sscf->verify) {
rc = SSL_get_verify_result(c->ssl->connection);
if (rc != X509_V_OK) {
@ -1539,20 +1539,22 @@ ngx_http_process_request(ngx_http_request_t *r)
return;
}
cert = SSL_get_peer_certificate(c->ssl->connection);
if (sscf->verify == 1) {
cert = SSL_get_peer_certificate(c->ssl->connection);
if (cert == NULL) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent no required SSL certificate");
if (cert == NULL) {
ngx_log_error(NGX_LOG_INFO, c->log, 0,
"client sent no required SSL certificate");
ngx_ssl_remove_cached_session(sscf->ssl.ctx,
ngx_ssl_remove_cached_session(sscf->ssl.ctx,
(SSL_get0_session(c->ssl->connection)));
ngx_http_finalize_request(r, NGX_HTTPS_NO_CERT);
return;
}
ngx_http_finalize_request(r, NGX_HTTPS_NO_CERT);
return;
}
X509_free(cert);
X509_free(cert);
}
}
}