# HG changeset patch
# User Francesco Giacomini <francesco.giacomini@cnaf.infn.it>
# Date 1552665342 -3600
# Fri Mar 15 16:55:42 2019 +0100
# Node ID 0b5d82532ea5c5be20af26f1d82a74b6cd451665
# Parent c74904a1702135f673a275bd0d36f010a3bfb89a
SSL: support for client proxy certificates

Add the option ssl_allow_proxy_certs to allow client authentication
through X.509 proxy certificates (RFC 3820).

It used to be possible by setting the environment variable
OPENSSL_ALLOW_PROXY_CERTS, but since OpenSSL 1.1 it has to be
done programmatically.

diff -r c74904a17021 -r 0b5d82532ea5 contrib/vim/syntax/nginx.vim
--- a/contrib/vim/syntax/nginx.vim Sat Mar 09 03:03:56 2019 +0300
+++ b/contrib/vim/syntax/nginx.vim Fri Mar 15 16:55:42 2019 +0100
@@ -581,6 +581,7 @@
syn keyword ngxDirective contained ssi_silent_errors
syn keyword ngxDirective contained ssi_types
syn keyword ngxDirective contained ssi_value_length
+syn keyword ngxDirective contained ssl_allow_proxy_certs
syn keyword ngxDirective contained ssl_buffer_size
syn keyword ngxDirective contained ssl_certificate
syn keyword ngxDirective contained ssl_certificate_key
diff -r c74904a17021 -r 0b5d82532ea5 src/event/ngx_event_openssl.c
--- a/src/event/ngx_event_openssl.c Sat Mar 09 03:03:56 2019 +0300
+++ b/src/event/ngx_event_openssl.c Fri Mar 15 16:55:42 2019 +0100
@@ -1471,6 +1471,29 @@


ngx_int_t
+ngx_ssl_allow_proxy_certs(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
+{
+ X509_STORE *store;
+
+ if (!enable) {
+ return NGX_OK;
+ }
+
+ store = SSL_CTX_get_cert_store(ssl->ctx);
+
+ if (store == NULL) {
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+ "SSL_CTX_get_cert_store() failed");
+ return NGX_ERROR;
+ }
+
+ X509_STORE_set_flags(store, X509_V_FLAG_ALLOW_PROXY_CERTS);
+
+ return NGX_OK;
+}
+
+
+ngx_int_t
ngx_ssl_client_session_cache(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_uint_t enable)
{
if (!enable) {
diff -r c74904a17021 -r 0b5d82532ea5 src/event/ngx_event_openssl.h
--- a/src/event/ngx_event_openssl.h Sat Mar 09 03:03:56 2019 +0300
+++ b/src/event/ngx_event_openssl.h Fri Mar 15 16:55:42 2019 +0100
@@ -180,6 +180,8 @@
ngx_str_t *file, ngx_str_t *responder, ngx_uint_t verify);
ngx_int_t ngx_ssl_stapling_resolver(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_resolver_t *resolver, ngx_msec_t resolver_timeout);
+ngx_int_t ngx_ssl_allow_proxy_certs(ngx_conf_t *cf, ngx_ssl_t *ssl,
+ ngx_uint_t enable);
RSA *ngx_ssl_rsa512_key_callback(ngx_ssl_conn_t *ssl_conn, int is_export,
int key_length);
ngx_array_t *ngx_ssl_read_password_file(ngx_conf_t *cf, ngx_str_t *file);
diff -r c74904a17021 -r 0b5d82532ea5 src/http/modules/ngx_http_ssl_module.c
--- a/src/http/modules/ngx_http_ssl_module.c Sat Mar 09 03:03:56 2019 +0300
+++ b/src/http/modules/ngx_http_ssl_module.c Fri Mar 15 16:55:42 2019 +0100
@@ -249,6 +249,13 @@
offsetof(ngx_http_ssl_srv_conf_t, early_data),
NULL },

+ { ngx_string("ssl_allow_proxy_certs"),
+ NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_FLAG,
+ ngx_conf_set_flag_slot,
+ NGX_HTTP_SRV_CONF_OFFSET,
+ offsetof(ngx_http_ssl_srv_conf_t, allow_proxy_certs),
+ NULL },
+
ngx_null_command
};

@@ -580,6 +587,7 @@
sscf->session_ticket_keys = NGX_CONF_UNSET_PTR;
sscf->stapling = NGX_CONF_UNSET;
sscf->stapling_verify = NGX_CONF_UNSET;
+ sscf->allow_proxy_certs = NGX_CONF_UNSET;

return sscf;
}
@@ -647,6 +655,8 @@
ngx_conf_merge_str_value(conf->stapling_responder,
prev->stapling_responder, "");

+ ngx_conf_merge_value(conf->allow_proxy_certs, prev->allow_proxy_certs, 0);
+
conf->ssl.log = cf->log;

if (conf->enable) {
@@ -857,6 +867,10 @@
return NGX_CONF_ERROR;
}

+ if (ngx_ssl_allow_proxy_certs(cf, &conf->ssl, conf->allow_proxy_certs) != NGX_OK) {
+ return NGX_CONF_ERROR;
+ }
+
return NGX_CONF_OK;
}

diff -r c74904a17021 -r 0b5d82532ea5 src/http/modules/ngx_http_ssl_module.h
--- a/src/http/modules/ngx_http_ssl_module.h Sat Mar 09 03:03:56 2019 +0300
+++ b/src/http/modules/ngx_http_ssl_module.h Fri Mar 15 16:55:42 2019 +0100
@@ -59,6 +59,8 @@
ngx_str_t stapling_file;
ngx_str_t stapling_responder;

+ ngx_flag_t allow_proxy_certs;
+
u_char *file;
ngx_uint_t line;
} ngx_http_ssl_srv_conf_t;
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel