ngx.ssl.proxysslverify.set_verify_result(0) gets ignored
using OpenResty Version: 1.29.2.5
I am failing to set the "SSL verify result" to X509_V_OK, or better: When I set the verification result to 0 it gets ignored.
The upstream server certificate does not include the ip. The proxy pass connection URL uses the IPV4 URL so "verify result" is 18 when I ask for it and the nginx error message tells me that the IPV4 is not part of the upstream certificate.
I want to set the "verify result" to OK in this special case. If I run the same code using another value, greater than 0, it works! The behavior I expect that I can set the verification result to every value I can find in x509_vfy.h including the X509_V_OK (0). So setting this value to 0 would end up in positiv verification result.
my nginx.conf (constructed as an example for you)
server {
# ... reverse proxy configuration
location / {
proxy_ssl_verify "on";
proxy_ssl_trusted_certificate /etc/ssl/certs/ca-certificates.pem;
proxy_pass "https://192.168.0.41";
proxy_ssl_verify_by_lua_block {
local proxy_ssl_vfy = require "ngx.ssl.proxysslverify"
local log = ngx.log
local DEBUG = ngx.DEBUG
local INFO = ngx.NOTICE
local ERR = ngx.ERR
local result, err = proxy_ssl_vfy.get_verify_result()
log(INFO,"result:",result)
local cert, cert_err = proxy_ssl_vfy.get_verify_cert()
--local X509_V_OK=0
local X509_V_OK=3
if err then
log(ERR,err)
end
local ok, err = proxy_ssl_vfy.set_verify_result(X509_V_OK)
if not ok then
log(ERR, "failed to set ssl verify: ", err)
return ngx.exit(ngx.ERROR)
else
log(DEBUG, "successfully set verify result to:",X509_V_OK)
end
}
}
}
log-output:
8: result:18 while loading proxy ssl verify by lua
20: successfully set verify result to:3
upstream SSL certificate verify error: (3:unable to get certificate CRL) while proxy pass SSL handshaking
If I now change the value to zero (in line 16) before setting the result the output changes to:
8: result:18 while loading proxy ssl verify by lua
20: successfully set verify reult to:0
error: upstream SSL certificate does not match "192.168.0.41" while proxy pass SSL handshaking
To me, this is the same result as without setting any "verify result" by Lua.
Seems like I can overwrite the SSL verfication result with any value except zero. This way I can not bypass the verification, here I can only set Errors, not OK! Am I right that it should be possible to end up in HTTP200 by setting "verify result" to 0? If so, there might be a bug somewhere. If I comment out proxy_ssl_verify "on" the connection ends up in HTTP Code 200 (success).
ngx.ssl.proxysslverify.set_verify_result(0) gets ignored
using OpenResty Version: 1.29.2.5
I am failing to set the "SSL verify result" to X509_V_OK, or better: When I set the verification result to 0 it gets ignored.
The upstream server certificate does not include the ip. The proxy pass connection URL uses the IPV4 URL so "verify result" is 18 when I ask for it and the nginx error message tells me that the IPV4 is not part of the upstream certificate.
I want to set the "verify result" to OK in this special case. If I run the same code using another value, greater than 0, it works! The behavior I expect that I can set the verification result to every value I can find in x509_vfy.h including the X509_V_OK (0). So setting this value to 0 would end up in positiv verification result.
my nginx.conf (constructed as an example for you)
log-output:
If I now change the value to zero (in line 16) before setting the result the output changes to:
To me, this is the same result as without setting any "verify result" by Lua.
Seems like I can overwrite the SSL verfication result with any value except zero. This way I can not bypass the verification, here I can only set Errors, not OK! Am I right that it should be possible to end up in HTTP200 by setting "verify result" to 0? If so, there might be a bug somewhere. If I comment out proxy_ssl_verify "on" the connection ends up in HTTP Code 200 (success).