Skip to content

Commit 5246add

Browse files
willmafhwillmafh
authored
feature: proxy_ssl_verify_by_lua directives.
1 parent 63f4e2d commit 5246add

15 files changed

+1958
-1
lines changed

‎README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ behavior.
151151
* [ssl_client_hello_by_lua_file](https://github.com/openresty/lua-nginx-module#ssl_client_hello_by_lua_file)
152152
* [ssl_certificate_by_lua_block](https://github.com/openresty/lua-nginx-module#ssl_certificate_by_lua_block)
153153
* [ssl_certificate_by_lua_file](https://github.com/openresty/lua-nginx-module#ssl_certificate_by_lua_file)
154+
* [proxy_ssl_verify_by_lua_block](https://github.com/openresty/lua-nginx-module#proxy_ssl_verify_by_lua_block)
155+
* [proxy_ssl_verify_by_lua_file](https://github.com/openresty/lua-nginx-module#proxy_ssl_verify_by_lua_file)
154156
* [lua_shared_dict](https://github.com/openresty/lua-nginx-module#lua_shared_dict)
155157
* [lua_socket_connect_timeout](https://github.com/openresty/lua-nginx-module#lua_socket_connect_timeout)
156158
* [lua_socket_buffer_size](https://github.com/openresty/lua-nginx-module#lua_socket_buffer_size)
@@ -166,6 +168,7 @@ behavior.
166168
* [lua_ssl_verify_depth](https://github.com/openresty/lua-nginx-module#lua_ssl_verify_depth)
167169
* [lua_ssl_key_log](https://github.com/openresty/lua-nginx-module#lua_ssl_key_log)
168170
* [lua_ssl_conf_command](https://github.com/openresty/lua-nginx-module#lua_ssl_conf_command)
171+
* [lua_upstream_skip_openssl_default_verify](https://github.com/openresty/lua-nginx-module#lua_upstream_skip_openssl_default_verify)
169172
* [lua_check_client_abort](https://github.com/openresty/lua-nginx-module#lua_check_client_abort)
170173
* [lua_max_pending_timers](https://github.com/openresty/lua-nginx-module#lua_max_pending_timers)
171174
* [lua_max_running_timers](https://github.com/openresty/lua-nginx-module#lua_max_running_timers)

‎config‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,7 @@ STREAM_LUA_SRCS=" \
278278
$ngx_addon_dir/src/ngx_stream_lua_semaphore.c \
279279
$ngx_addon_dir/src/ngx_stream_lua_ssl_client_helloby.c \
280280
$ngx_addon_dir/src/ngx_stream_lua_ssl_certby.c \
281+
$ngx_addon_dir/src/ngx_stream_lua_proxy_ssl_verifyby.c \
281282
$ngx_addon_dir/src/ngx_stream_lua_log_ringbuf.c \
282283
$ngx_addon_dir/src/ngx_stream_lua_input_filters.c \
283284
"
@@ -322,6 +323,7 @@ STREAM_LUA_DEPS=" \
322323
$ngx_addon_dir/src/ngx_stream_lua_semaphore.h \
323324
$ngx_addon_dir/src/ngx_stream_lua_ssl_client_helloby.h \
324325
$ngx_addon_dir/src/ngx_stream_lua_ssl_certby.h \
326+
$ngx_addon_dir/src/ngx_stream_lua_proxy_ssl_verifyby.h \
325327
$ngx_addon_dir/src/ngx_stream_lua_log_ringbuf.h \
326328
$ngx_addon_dir/src/ngx_stream_lua_input_filters.h \
327329
"

‎src/ngx_stream_lua_common.h‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,6 +136,10 @@
136136
#define NGX_STREAM_LUA_CONTEXT_SSL_CERT 0x0040
137137
#define NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO 0x0080
138138

139+
#ifdef HAVE_PROXY_SSL_PATCH
140+
#define NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY 0x0100
141+
#endif
142+
139143

140144
#define NGX_STREAM_LUA_FFI_NO_REQ_CTX -100
141145
#define NGX_STREAM_LUA_FFI_BAD_CONTEXT -101
@@ -270,6 +274,17 @@ struct ngx_stream_lua_srv_conf_s {
270274
ngx_str_t ssl_client_hello_src;
271275
u_char *ssl_client_hello_src_key;
272276
} srv;
277+
278+
#ifdef HAVE_PROXY_SSL_PATCH
279+
struct {
280+
ngx_stream_lua_srv_conf_handler_pt proxy_ssl_verify_handler;
281+
ngx_str_t proxy_ssl_verify_src;
282+
u_char *proxy_ssl_verify_src_key;
283+
284+
ngx_flag_t upstream_skip_openssl_default_verify;
285+
} ups;
286+
#endif
287+
273288
#endif
274289

275290
ngx_flag_t enable_code_cache; /* whether to enable

‎src/ngx_stream_lua_control.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -116,13 +116,19 @@ ngx_stream_lua_ffi_exit(ngx_stream_lua_request_t *r, int status, u_char *err,
116116
| NGX_STREAM_LUA_CONTEXT_BALANCER
117117
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
118118
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
119+
#ifdef HAVE_PROXY_SSL_PATCH
120+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
121+
#endif
119122
| NGX_STREAM_LUA_CONTEXT_PREREAD,
120123
err, errlen) != NGX_OK)
121124
{
122125
return NGX_ERROR;
123126
}
124127

125128
if (ctx->context & (NGX_STREAM_LUA_CONTEXT_SSL_CERT
129+
#ifdef HAVE_PROXY_SSL_PATCH
130+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
131+
#endif
126132
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO ))
127133
{
128134

‎src/ngx_stream_lua_coroutine.c‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -205,6 +205,9 @@ ngx_stream_lua_coroutine_resume(lua_State *L)
205205
| NGX_STREAM_LUA_CONTEXT_TIMER
206206
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
207207
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
208+
#ifdef HAVE_PROXY_SSL_PATCH
209+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
210+
#endif
208211
| NGX_STREAM_LUA_CONTEXT_PREREAD
209212
);
210213

@@ -266,6 +269,9 @@ ngx_stream_lua_coroutine_yield(lua_State *L)
266269
| NGX_STREAM_LUA_CONTEXT_TIMER
267270
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
268271
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
272+
#ifdef HAVE_PROXY_SSL_PATCH
273+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
274+
#endif
269275
| NGX_STREAM_LUA_CONTEXT_PREREAD
270276
);
271277

@@ -426,6 +432,9 @@ ngx_stream_lua_coroutine_status(lua_State *L)
426432
| NGX_STREAM_LUA_CONTEXT_TIMER
427433
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
428434
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
435+
#ifdef HAVE_PROXY_SSL_PATCH
436+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
437+
#endif
429438
| NGX_STREAM_LUA_CONTEXT_PREREAD
430439
);
431440

‎src/ngx_stream_lua_module.c‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,10 @@
3131
#include "ngx_stream_lua_ssl_client_helloby.h"
3232
#include "ngx_stream_lua_ssl_certby.h"
3333

34+
#ifdef HAVE_PROXY_SSL_PATCH
35+
#include "ngx_stream_lua_proxy_ssl_verifyby.h"
36+
#endif
37+
3438

3539
#include "ngx_stream_lua_prereadby.h"
3640

@@ -422,6 +426,30 @@ static ngx_command_t ngx_stream_lua_cmds[] = {
422426
0,
423427
(void *) ngx_stream_lua_ssl_cert_handler_file },
424428

429+
#ifdef HAVE_PROXY_SSL_PATCH
430+
/* same context as proxy_pass directive */
431+
{ ngx_string("proxy_ssl_verify_by_lua_block"),
432+
NGX_STREAM_SRV_CONF|NGX_CONF_BLOCK|NGX_CONF_NOARGS,
433+
ngx_stream_lua_proxy_ssl_verify_by_lua_block,
434+
NGX_STREAM_SRV_CONF_OFFSET,
435+
0,
436+
(void *) ngx_stream_lua_proxy_ssl_verify_handler_inline },
437+
438+
{ ngx_string("proxy_ssl_verify_by_lua_file"),
439+
NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
440+
ngx_stream_lua_proxy_ssl_verify_by_lua,
441+
NGX_STREAM_SRV_CONF_OFFSET,
442+
0,
443+
(void *) ngx_stream_lua_proxy_ssl_verify_handler_file },
444+
445+
{ ngx_string("lua_upstream_skip_openssl_default_verify"),
446+
NGX_STREAM_SRV_CONF|NGX_CONF_FLAG,
447+
ngx_conf_set_flag_slot,
448+
NGX_STREAM_SRV_CONF_OFFSET,
449+
offsetof(ngx_stream_lua_srv_conf_t,
450+
ups.upstream_skip_openssl_default_verify),
451+
NULL },
452+
#endif
425453

426454
{ ngx_string("lua_ssl_verify_depth"),
427455
NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
@@ -827,6 +855,10 @@ ngx_stream_lua_create_srv_conf(ngx_conf_t *cf)
827855
* lscf->srv.ssl_client_hello_src = { 0, NULL };
828856
* lscf->srv.ssl_client_hello_src_key = NULL;
829857
*
858+
* lscf->ups.proxy_ssl_verify_handler = NULL;
859+
* lscf->ups.proxy_ssl_verify_src = { 0, NULL };
860+
* lscf->ups.proxy_ssl_verify_src_key = NULL;
861+
*
830862
* lscf->srv.ssl_cert_handler = NULL;
831863
* lscf->srv.ssl_cert_src = { 0, NULL };
832864
* lscf->srv.ssl_cert_src_key = NULL;
@@ -868,6 +900,9 @@ ngx_stream_lua_create_srv_conf(ngx_conf_t *cf)
868900
conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
869901
conf->ssl_certificates = NGX_CONF_UNSET_PTR;
870902
conf->ssl_certificate_keys = NGX_CONF_UNSET_PTR;
903+
#ifdef HAVE_PROXY_SSL_PATCH
904+
conf->ups.upstream_skip_openssl_default_verify = NGX_CONF_UNSET;
905+
#endif
871906
#endif
872907

873908
return conf;
@@ -1002,6 +1037,23 @@ ngx_stream_lua_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
10021037
NULL);
10031038
#endif
10041039

1040+
#ifdef HAVE_PROXY_SSL_PATCH
1041+
if (conf->ups.proxy_ssl_verify_src.len == 0) {
1042+
conf->ups.proxy_ssl_verify_src = prev->ups.proxy_ssl_verify_src;
1043+
conf->ups.proxy_ssl_verify_handler = prev->ups.proxy_ssl_verify_handler;
1044+
conf->ups.proxy_ssl_verify_src_key = prev->ups.proxy_ssl_verify_src_key;
1045+
}
1046+
1047+
if (conf->ups.proxy_ssl_verify_src.len) {
1048+
if (ngx_stream_lua_proxy_ssl_verify_set_callback(cf) != NGX_OK) {
1049+
return NGX_CONF_ERROR;
1050+
}
1051+
}
1052+
1053+
ngx_conf_merge_value(conf->ups.upstream_skip_openssl_default_verify,
1054+
prev->ups.upstream_skip_openssl_default_verify, 0);
1055+
#endif
1056+
10051057
if (ngx_stream_lua_set_ssl(cf, conf) != NGX_OK) {
10061058
return NGX_CONF_ERROR;
10071059
}

‎src/ngx_stream_lua_phase.c‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -66,6 +66,12 @@ ngx_stream_lua_ngx_get_phase(lua_State *L)
6666
lua_pushliteral(L, "content");
6767
break;
6868

69+
#ifdef HAVE_PROXY_SSL_PATCH
70+
case NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY:
71+
lua_pushliteral(L, "proxy_ssl_verify");
72+
break;
73+
#endif
74+
6975
case NGX_STREAM_LUA_CONTEXT_LOG:
7076
lua_pushliteral(L, "log");
7177
break;

0 commit comments

Comments
 (0)