theforeman/smart-proxy — pull request #217 by domcleal (2014-10-07 11:01:15+00:00)
Title: fixes #7822 - forbid HTTPS requests with no client SSL certificate

Please review as a priority, and test heavily. It seems that OpenSSL correctly refuses connections when the certificate presented isn't trusted by the CA that the server is using (note, we don't have separate client/server CAs), and the problem is only when no client cert is presented.

I can't see a way to check that relying on OpenSSL for bad verification is always solid. The closest I've found is that the socket that WEBrick sees has an OpenSSL verification result attached (http://ruby-doc.org/stdlib-1.9.3/libdoc/openssl/rdoc/OpenSSL/SSL/SSLSocket.html) but I can't see a way to get at that. In any case, it only seems to reach the smart proxy when there's either no cert or it validates.

Lastly, I'm looking at more tests in the 7822-ssl-verify branch which test Proxy::Launcher's https_app by spinning up the rack/WEBrick app and then make requests, but this will take more refactoring.

No CVE assigned yet - will add it to commit message before it's merged.