Support ssl_client_verify optional and $ssl_client_verify
Author: Brice Figureau
Copyright (C) 2009 Days of Wonder Inc. All rights reserved.
--------------------------------------------------------------------
LICENSE::
Redistribution and use in source and binary forms, with or without
modification, are permitted provided that the following conditions
are met:
1. Redistributions of source code must retain the above copyright
   notice, this list of conditions and the following disclaimer.
2. Redistributions in binary form must reproduce the above copyright
   notice, this list of conditions and the following disclaimer in the
   documentation and/or other materials provided with the distribution.

THIS SOFTWARE IS PROVIDED BY AUTHOR AND CONTRIBUTORS ``AS IS'' AND
ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
ARE DISCLAIMED.  IN NO EVENT SHALL AUTHOR OR CONTRIBUTORS BE LIABLE
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
SUCH DAMAGE.
--------------------------------------------------------------------------

Support ssl_client_verify optional and $ssl_client_verify

This is to match Apache features.
This also allow puppet to have a simpler configuration.

Usage:

	ssl_client_verification optional;

In Optional mode, if the client sends a certificate it is verified.
If it is ok, the connection is allowed, otherwise it is denied.
If no certificate are sent by the client, then the connection
if allowed.

The variable $ssl_verify_client can contain:
 * NONE: no client certificate were sent
 * SUCCESS: the certificate verified successfully
 * FAILURE: the certificate is invalid

Signed-off-by: Brice Figureau <brice+nginx@daysofwonder.com>
---
 src/event/ngx_event_openssl.c          |   35 ++++++++++++++++++++++++++++++++
 src/event/ngx_event_openssl.h          |    2 +
 src/http/modules/ngx_http_ssl_module.c |    5 +++-
 src/http/ngx_http_request.c            |    9 ++++---
 4 files changed, 46 insertions(+), 5 deletions(-)

diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 23a4fbe..9cfdb50 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -2107,6 +2107,41 @@ ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
     return NGX_OK;
 }
 
+ngx_int_t
+ngx_ssl_get_verify_client(ngx_connection_t *c, ngx_pool_t *pool, ngx_str_t *s)
+{
+    X509       *cert;
+    ngx_int_t   code;
+		long				verified;
+    static ngx_str_t  ngx_http_ssl_verify_result[] = {
+        ngx_string("NONE"),
+        ngx_string("SUCCESS"),
+        ngx_string("FAILED"),
+    };
+
+    s->len = 0;
+
+    cert = SSL_get_peer_certificate(c->ssl->connection);
+    verified = SSL_get_verify_result(c->ssl->connection);
+
+    if (cert == NULL && verified == X509_V_OK) {
+        code = 0;
+    } else if (cert != NULL && verified == X509_V_OK) {
+        code = 1;
+    } else {
+        code = 2;
+    }
+
+    if (cert) {
+        X509_free(cert);
+    }
+
+    s->len = ngx_http_ssl_verify_result[code].len;
+    s->data = ngx_pnalloc(pool, s->len);
+    ngx_memcpy(s->data, ngx_http_ssl_verify_result[code].data, s->len);
+
+    return NGX_OK;
+}
 
 static void *
 ngx_openssl_create_conf(ngx_cycle_t *cycle)
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index 1e83606..ff19de8 100644
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -131,6 +131,8 @@ ngx_int_t ngx_ssl_get_issuer_dn(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
 ngx_int_t ngx_ssl_get_serial_number(ngx_connection_t *c, ngx_pool_t *pool,
     ngx_str_t *s);
+ngx_int_t ngx_ssl_get_verify_client(ngx_connection_t *c, ngx_pool_t *pool,
+    ngx_str_t *s);
 
 
 ngx_int_t ngx_ssl_handshake(ngx_connection_t *c);
diff --git a/src/http/modules/ngx_http_ssl_module.c b/src/http/modules/ngx_http_ssl_module.c
index 3bf52a2..c6f7441 100644
--- a/src/http/modules/ngx_http_ssl_module.c
+++ b/src/http/modules/ngx_http_ssl_module.c
@@ -52,7 +52,7 @@ static ngx_conf_bitmask_t  ngx_http_ssl_protocols[] = {
 static ngx_conf_enum_t  ngx_http_ssl_verify[] = {
     { ngx_string("off"), 0 },
     { ngx_string("on"), 1 },
-    { ngx_string("ask"), 2 },
+    { ngx_string("optional"), 2 },
     { ngx_null_string, 0 }
 };
 
@@ -206,6 +206,9 @@ static ngx_http_variable_t  ngx_http_ssl_vars[] = {
     { ngx_string("ssl_client_serial"), NULL, ngx_http_ssl_variable,
       (uintptr_t) ngx_ssl_get_serial_number, NGX_HTTP_VAR_CHANGEABLE, 0 },
 
+    { ngx_string("ssl_client_verify"), NULL, ngx_http_ssl_variable,
+      (uintptr_t) ngx_ssl_get_verify_client, NGX_HTTP_VAR_CHANGEABLE, 0 },
+
     { ngx_null_string, NULL, NULL, 0, 0, 0 }
 };
 
diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index c9c6db7..6c59638 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -1503,7 +1503,7 @@ ngx_http_process_request(ngx_http_request_t *r)
 
         sscf = ngx_http_get_module_srv_conf(r, ngx_http_ssl_module);
 
-        if (sscf->verify == 1) {
+        if (sscf->verify > 0) {
             rc = SSL_get_verify_result(c->ssl->connection);
 
             if (rc != X509_V_OK) {
@@ -1520,7 +1520,7 @@ ngx_http_process_request(ngx_http_request_t *r)
 
             cert = SSL_get_peer_certificate(c->ssl->connection);
 
-            if (cert == NULL) {
+            if (cert == NULL && sscf->verify == 1) {
                 ngx_log_error(NGX_LOG_INFO, c->log, 0,
                               "client sent no required SSL certificate");
 
@@ -1530,8 +1530,9 @@ ngx_http_process_request(ngx_http_request_t *r)
                 ngx_http_finalize_request(r, NGX_HTTPS_NO_CERT);
                 return;
             }
-
-            X509_free(cert);
+            if (cert != NULL) {
+              X509_free(cert);
+            }
         }
     }
 
-- 
1.5.6.5

