Skip to content

feature: add FFI interface to verify SSL client certificate #1666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 13 commits into from
Jul 30, 2020
Merged

feature: add FFI interface to verify SSL client certificate #1666

Changes from 1 commit
Commits
Show all changes
13 commits
Select commit Hold shift + click to select a range
abfee94
feature: add FFI interface to verify SSL client certificate
ArchangelSDY Feb 25, 2020
6c25967
tests: add unit tests for client certificate verification API
ArchangelSDY Mar 28, 2020
f4803ff
style: address review issues
ArchangelSDY Apr 7, 2020
8eb9ab9
feature: make client cert verify depth optional
ArchangelSDY Apr 18, 2020
017a1aa
feature: set default client cert verify depth to 1
ArchangelSDY Apr 19, 2020
76e8b97
tests: use a different cert for server side cert
ArchangelSDY Apr 20, 2020
e9577ed
tests: refine and clean up
ArchangelSDY Apr 21, 2020
889b9a7
feature: check context when calling ssl.verify_client
ArchangelSDY Apr 21, 2020
6b58760
bugfix: set client cert verify store per connection
ArchangelSDY Jun 8, 2020
1206d9c
bugfix: goto failed when failed to create `name_chain`
ArchangelSDY Jun 9, 2020
72f3124
bugfix: fix error message
ArchangelSDY Jun 9, 2020
ca0ae92
style: address review comments
ArchangelSDY Jul 22, 2020
1691004
bugfix: fix memory leak in test cases
ArchangelSDY Jul 22, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 8 additions & 1 deletion src/ngx_http_lua_ssl_certby.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1367,7 +1367,7 @@ ngx_http_lua_ffi_ssl_verify_client(ngx_http_request_t *r, void *ca_certs,
/* set CA chain */

if (chain != NULL) {
ca_store = SSL_CTX_get_cert_store(SSL_get_SSL_CTX(ssl_conn));
ca_store = X509_STORE_new();
if (ca_store == NULL) {
*err = "SSL_CTX_get_cert_store() failed";
return NGX_ERROR;
Expand Down Expand Up @@ -1408,13 +1408,20 @@ ngx_http_lua_ffi_ssl_verify_client(ngx_http_request_t *r, void *ca_certs,
}
}

if (SSL_set0_verify_cert_store(ssl_conn, ca_store) == 0) {
*err = "SSL_set0_verify_cert_store() failed";
goto failed;
}

SSL_set_client_CA_list(ssl_conn, name_chain);
}

return NGX_OK;

failed:

X509_STORE_free(ca_store);

sk_X509_NAME_free(name_chain);

return NGX_ERROR;
Expand Down