yaoweibin/nginx_tcp_proxy_module — pull request #97 by jeffsplender (2014-07-10 10:32:34+00:00)
Title: Ssl verify client certificate check

This commit fixes following issue:
When "ssl_verify_client on" is set for tcp proxy module, it's still possible to connect and work through nginx tcp proxy without client certificate.

After the fix (expected behavior):
When "ssl_verify_client on" is set, all connections without client certificate or with improper client certificate will be rejected (with handshake failure). When "ssl_verify_client optional" is set, connections without client certificate will pass, and connections with improper client certificate will be rejected.

Tested on:
nginx v1.7.0, v1.4.4, v0.7.65 - nginx builds, starts and performs as expected when connected with openssl s_client (both "ssl_verify_client on" and "ssl_verify_client optional" tested)
nginx v1.4.4 - works on test environment with constant load for 2 month without issue.

v1.7.3 problem:
Then building nginx v1.7.3 I got following error:
~/workspace/nginx_tcp_proxy_module/modules/ngx_tcp_ssl_module.c: In function ‘ngx_tcp_ssl_merge_srv_conf’:
~/workspace/nginx_tcp_proxy_module/modules/ngx_tcp_ssl_module.c:330:29: error: too few arguments to function ‘ngx_ssl_certificate’
In file included from src/core/ngx_core.h:73:0,
from ~/workspace/nginx_tcp_proxy_module/modules/ngx_tcp_ssl_module.c:3:
src/event/ngx_event_openssl.h:114:11: note: declared here

That is caused by changes in nginx code:
git diff v1.7.0 v1.7.3 -- src/event/ngx_event_openssl.h
ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
- ngx_str_t *cert, ngx_str_t *key);
+ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);

I don't consider it as problem caused by my fix because I got the same error when tried to build nginx v1.7.3 with nginx_tcp_proxy_module/master.

P.S.: related issue https://github.com/yaoweibin/nginx_tcp_proxy_module/issues/94 (not by me)