From acd53645754ce42b436cecb0d7a10b547d41fef6 Mon Sep 17 00:00:00 2001 From: lijunlong Date: Wed, 13 Oct 2021 23:42:17 +0800 Subject: [PATCH 01/17] bugfix: nginx crash when resolve an not exist domain in thread create by ngx.thread.spawn.(#1931) FIX #1915 The resolve ctxes were dded to a link list. function ngx_resolver_process_a iterate through the link list when got the DNS reply. When processing the first resolve ctx, all the three ctxes were freed. So when ngx_resolver_process_a continues to process the second ctx, it will free the ctx again. Co-authored-by: doujiang24 --- src/ngx_http_lua_socket_tcp.c | 15 ++------------- 1 file changed, 2 insertions(+), 13 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 55bd203d..b7c3bdd4 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -147,8 +147,6 @@ static void ngx_http_lua_socket_free_pool(ngx_log_t *log, static int ngx_http_lua_socket_shutdown_pool(lua_State *L); static void ngx_http_lua_socket_shutdown_pool_helper( ngx_http_lua_socket_pool_t *spool); -static void - ngx_http_lua_socket_empty_resolve_handler(ngx_resolver_ctx_t *ctx); static int ngx_http_lua_socket_prepare_error_retvals(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L, ngx_uint_t ft_type); #if (NGX_HTTP_SSL) @@ -1151,13 +1149,6 @@ ngx_http_lua_socket_tcp_connect(lua_State *L) } -static void -ngx_http_lua_socket_empty_resolve_handler(ngx_resolver_ctx_t *ctx) -{ - /* do nothing */ -} - - static void ngx_http_lua_socket_resolve_handler(ngx_resolver_ctx_t *ctx) { @@ -6084,10 +6075,8 @@ ngx_http_lua_tcp_resolve_cleanup(void *data) return; } - /* just to be safer */ - rctx->handler = ngx_http_lua_socket_empty_resolve_handler; - - ngx_resolve_name_done(rctx); + /* postpone free the rctx in the handler */ + rctx->handler = ngx_resolve_name_done; } -- 2.32.0 (Apple Git-132) From 59d39ca2f0963695052c2593f957053f1a1779a2 Mon Sep 17 00:00:00 2001 From: Josh Soref <2119212+jsoref@users.noreply.github.com> Date: Mon, 25 Oct 2021 03:07:01 -0400 Subject: [PATCH 02/17] doc: fixed spelling errors in the docs and code. (#1947) --- src/ngx_http_lua_socket_tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index b7c3bdd4..ace18a0f 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -3112,7 +3112,7 @@ ngx_http_lua_socket_tcp_settimeout(lua_State *L) n = lua_gettop(L); if (n != 2) { - return luaL_error(L, "ngx.socket settimout: expecting 2 arguments " + return luaL_error(L, "ngx.socket settimeout: expecting 2 arguments " "(including the object) but seen %d", lua_gettop(L)); } @@ -3159,7 +3159,7 @@ ngx_http_lua_socket_tcp_settimeouts(lua_State *L) n = lua_gettop(L); if (n != 4) { - return luaL_error(L, "ngx.socket settimout: expecting 4 arguments " + return luaL_error(L, "ngx.socket settimeout: expecting 4 arguments " "(including the object) but seen %d", lua_gettop(L)); } -- 2.32.0 (Apple Git-132) From 617cb5dadc14dddb4796d4fff8821dae325f4229 Mon Sep 17 00:00:00 2001 From: Sharp Liu Date: Tue, 26 Oct 2021 17:53:54 +0800 Subject: [PATCH 03/17] style: removed extra space. (#1952) --- src/ngx_http_lua_socket_tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index ace18a0f..26467fdd 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -2825,7 +2825,7 @@ ngx_http_lua_socket_tcp_send(lua_State *L) switch (type) { case LUA_TNUMBER: - b->last = ngx_http_lua_write_num(L, 2, b->last); + b->last = ngx_http_lua_write_num(L, 2, b->last); break; case LUA_TSTRING: -- 2.32.0 (Apple Git-132) From 287d58810c450f912a8d31a94a1c86ccc039c0e1 Mon Sep 17 00:00:00 2001 From: Datong Sun Date: Wed, 18 Sep 2019 16:39:05 -0700 Subject: [PATCH 04/17] cosocket: add function `tcpsock:tlshandshake`, retired the Lua C API based `tcpsock:sslhandshake` implementation. --- src/ngx_http_lua_socket_tcp.c | 387 +++++++++++++++------------------- src/ngx_http_lua_socket_tcp.h | 3 + 2 files changed, 177 insertions(+), 213 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 26467fdd..4ef22c11 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -23,6 +23,9 @@ static int ngx_http_lua_socket_tcp(lua_State *L); static int ngx_http_lua_socket_tcp_connect(lua_State *L); #if (NGX_HTTP_SSL) static int ngx_http_lua_socket_tcp_sslhandshake(lua_State *L); +static void ngx_http_lua_tls_handshake_handler(ngx_connection_t *c); +static int ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, + ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L); #endif static int ngx_http_lua_socket_tcp_receive(lua_State *L); static int ngx_http_lua_socket_tcp_receiveany(lua_State *L); @@ -149,12 +152,6 @@ static void ngx_http_lua_socket_shutdown_pool_helper( ngx_http_lua_socket_pool_t *spool); static int ngx_http_lua_socket_prepare_error_retvals(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L, ngx_uint_t ft_type); -#if (NGX_HTTP_SSL) -static int ngx_http_lua_ssl_handshake_retval_handler(ngx_http_request_t *r, - ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L); -static void ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c); -static int ngx_http_lua_ssl_free_session(lua_State *L); -#endif static void ngx_http_lua_socket_tcp_close_connection(ngx_connection_t *c); @@ -324,13 +321,6 @@ ngx_http_lua_inject_socket_tcp_api(ngx_log_t *log, lua_State *L) lua_pushcfunction(L, ngx_http_lua_socket_tcp_connect); lua_setfield(L, -2, "connect"); -#if (NGX_HTTP_SSL) - - lua_pushcfunction(L, ngx_http_lua_socket_tcp_sslhandshake); - lua_setfield(L, -2, "sslhandshake"); - -#endif - lua_pushcfunction(L, ngx_http_lua_socket_tcp_receive); lua_setfield(L, -2, "receive"); @@ -404,19 +394,6 @@ ngx_http_lua_inject_socket_tcp_api(ngx_log_t *log, lua_State *L) lua_setfield(L, -2, "__gc"); lua_rawset(L, LUA_REGISTRYINDEX); /* }}} */ - -#if (NGX_HTTP_SSL) - - /* {{{ssl session userdata metatable */ - lua_pushlightuserdata(L, ngx_http_lua_lightudata_mask( - ssl_session_metatable_key)); - lua_createtable(L, 0 /* narr */, 1 /* nrec */); /* metatable */ - lua_pushcfunction(L, ngx_http_lua_ssl_free_session); - lua_setfield(L, -2, "__gc"); - lua_rawset(L, LUA_REGISTRYINDEX); - /* }}} */ - -#endif } @@ -1559,64 +1536,69 @@ ngx_http_lua_socket_conn_error_retval_handler(ngx_http_request_t *r, #if (NGX_HTTP_SSL) -static int -ngx_http_lua_socket_tcp_sslhandshake(lua_State *L) +static const char * +ngx_http_lua_socket_tcp_check_busy(ngx_http_request_t *r, + ngx_http_lua_socket_tcp_upstream_t *u, unsigned int ops) { - int n, top; - ngx_int_t rc; - ngx_str_t name = ngx_null_string; - ngx_connection_t *c; - ngx_ssl_session_t **psession; - ngx_http_request_t *r; - ngx_http_lua_ctx_t *ctx; - ngx_http_lua_co_ctx_t *coctx; - - ngx_http_lua_socket_tcp_upstream_t *u; - - /* Lua function arguments: self [,session] [,host] [,verify] - [,send_status_req] */ + if (ops & SOCKET_OP_CONNECT && u->conn_waiting) { + return "socket busy connecting"; + } - n = lua_gettop(L); - if (n < 1 || n > 5) { - return luaL_error(L, "ngx.socket sslhandshake: expecting 1 ~ 5 " - "arguments (including the object), but seen %d", n); + if (ops & SOCKET_OP_READ && u->read_waiting) { + return "socket busy reading"; } - r = ngx_http_lua_get_req(L); - if (r == NULL) { - return luaL_error(L, "no request found"); + if (ops & SOCKET_OP_WRITE + && (u->write_waiting + || (u->raw_downstream + && (r->connection->buffered & NGX_HTTP_LOWLEVEL_BUFFERED)))) + { + return "socket busy writing"; } - ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "lua tcp socket ssl handshake"); + return NULL; +} - luaL_checktype(L, 1, LUA_TTABLE); +int +ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, + ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t *sess, + int enable_session_reuse, ngx_str_t *server_name, int verify, + int ocsp_status_req, const char **errmsg) +{ + ngx_int_t rc; + ngx_connection_t *c; + ngx_http_lua_ctx_t *ctx; + ngx_http_lua_co_ctx_t *coctx; + const char *busy_rc; - lua_rawgeti(L, 1, SOCKET_CTX_INDEX); - u = lua_touserdata(L, -1); + ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "lua tcp socket tls handshake"); if (u == NULL || u->peer.connection == NULL || u->read_closed || u->write_closed) { - lua_pushnil(L); - lua_pushliteral(L, "closed"); - return 2; + *errmsg = "closed"; + return NGX_ERROR; } if (u->request != r) { - return luaL_error(L, "bad request"); + *errmsg = "bad request"; + return NGX_ERROR; } - ngx_http_lua_socket_check_busy_connecting(r, u, L); - ngx_http_lua_socket_check_busy_reading(r, u, L); - ngx_http_lua_socket_check_busy_writing(r, u, L); + busy_rc = ngx_http_lua_socket_tcp_check_busy(r, u, SOCKET_OP_CONNECT + | SOCKET_OP_READ + | SOCKET_OP_WRITE); + if (busy_rc != NULL) { + *errmsg = busy_rc; + return NGX_ERROR; + } if (u->raw_downstream || u->body_downstream) { - lua_pushnil(L); - lua_pushliteral(L, "not supported for downstream"); - return 2; + *errmsg = "not supported for downstream"; + return NGX_ERROR; } c = u->peer.connection; @@ -1624,122 +1606,96 @@ ngx_http_lua_socket_tcp_sslhandshake(lua_State *L) u->ssl_session_reuse = 1; if (c->ssl && c->ssl->handshaked) { - switch (lua_type(L, 2)) { - case LUA_TUSERDATA: - lua_pushvalue(L, 2); - break; + if (sess != NULL) { + return NGX_DONE; + } - case LUA_TBOOLEAN: - if (!lua_toboolean(L, 2)) { - /* avoid generating the ssl session */ - lua_pushboolean(L, 1); - break; - } - /* fall through */ + u->ssl_session_reuse = enable_session_reuse; - default: - ngx_http_lua_ssl_handshake_retval_handler(r, u, L); - break; - } + (void) ngx_http_lua_tls_handshake_retval_handler(r, u, NULL); - return 1; + return NGX_OK; } if (ngx_ssl_create_connection(u->conf->ssl, c, NGX_SSL_BUFFER|NGX_SSL_CLIENT) != NGX_OK) { - lua_pushnil(L); - lua_pushliteral(L, "failed to create ssl connection"); - return 2; + *errmsg = "failed to create ssl connection"; + return NGX_ERROR; } ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module); if (ctx == NULL) { - return luaL_error(L, "no ctx found"); + ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, + "no ngx_lua ctx found while TLS handshaking"); + + ngx_http_lua_assert(NULL); + + *errmsg = "no ctx found"; + return NGX_ERROR; } coctx = ctx->cur_co_ctx; c->sendfile = 0; - if (n >= 2) { - if (lua_type(L, 2) == LUA_TBOOLEAN) { - u->ssl_session_reuse = lua_toboolean(L, 2); - - } else { - psession = lua_touserdata(L, 2); - - if (psession != NULL && *psession != NULL) { - if (ngx_ssl_set_session(c, *psession) != NGX_OK) { - lua_pushnil(L); - lua_pushliteral(L, "lua ssl set session failed"); - return 2; - } - - ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, - "lua ssl set session: %p", *psession); - } + if (sess != NULL) { + if (ngx_ssl_set_session(c, sess) != NGX_OK) { + *errmsg = "lua tls set session failed"; + return NGX_ERROR; } - if (n >= 3) { - name.data = (u_char *) lua_tolstring(L, 3, &name.len); + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, + "lua tls set session: %p", sess); - if (name.data) { - ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "lua ssl server name: \"%*s\"", name.len, - name.data); + } else { + u->ssl_session_reuse = enable_session_reuse; + } -#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + if (server_name != NULL && server_name->data != NULL) { + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "lua tls server name: \"%V\"", server_name); - if (SSL_set_tlsext_host_name(c->ssl->connection, - (char *) name.data) - == 0) - { - lua_pushnil(L); - lua_pushliteral(L, "SSL_set_tlsext_host_name failed"); - return 2; - } +#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME + if (SSL_set_tlsext_host_name(c->ssl->connection, + (char *) server_name->data) + == 0) + { + *errmsg = "SSL_set_tlsext_host_name failed"; + return NGX_ERROR; + } #else - - ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0, - "lua socket SNI disabled because the current " - "version of OpenSSL lacks the support"); - + *errmsg = "OpenSSL has no SNI support"; + return NGX_ERROR; #endif - } + } - if (n >= 4) { - u->ssl_verify = lua_toboolean(L, 4); + u->ssl_verify = verify; - if (n >= 5) { - if (lua_toboolean(L, 5)) { + if (ocsp_status_req) { #ifdef NGX_HTTP_LUA_USE_OCSP - SSL_set_tlsext_status_type(c->ssl->connection, - TLSEXT_STATUSTYPE_ocsp); + SSL_set_tlsext_status_type(c->ssl->connection, + TLSEXT_STATUSTYPE_ocsp); + #else - return luaL_error(L, "no OCSP support"); + *errmsg = "no OCSP support"; + return NGX_ERROR; #endif - } - } - } - } } - dd("found sni name: %.*s %p", (int) name.len, name.data, name.data); - - if (name.len == 0) { + if (server_name->len == 0) { u->ssl_name.len = 0; } else { if (u->ssl_name.data) { /* buffer already allocated */ - if (u->ssl_name.len >= name.len) { + if (u->ssl_name.len >= server_name->len) { /* reuse it */ - ngx_memcpy(u->ssl_name.data, name.data, name.len); - u->ssl_name.len = name.len; + ngx_memcpy(u->ssl_name.data, server_name->data, server_name->len); + u->ssl_name.len = server_name->len; } else { ngx_free(u->ssl_name.data); @@ -1750,17 +1706,16 @@ ngx_http_lua_socket_tcp_sslhandshake(lua_State *L) new_ssl_name: - u->ssl_name.data = ngx_alloc(name.len, ngx_cycle->log); + u->ssl_name.data = ngx_alloc(server_name->len, ngx_cycle->log); if (u->ssl_name.data == NULL) { u->ssl_name.len = 0; - lua_pushnil(L); - lua_pushliteral(L, "no memory"); - return 2; + *errmsg = "no memory"; + return NGX_ERROR; } - ngx_memcpy(u->ssl_name.data, name.data, name.len); - u->ssl_name.len = name.len; + ngx_memcpy(u->ssl_name.data, server_name->data, server_name->len); + u->ssl_name.len = server_name->len; } } @@ -1774,7 +1729,8 @@ new_ssl_name: rc = ngx_ssl_handshake(c); - dd("ngx_ssl_handshake returned %d", (int) rc); + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "ngx_ssl_handshake returned %d", rc); if (rc == NGX_AGAIN) { if (c->write->timer_set) { @@ -1784,13 +1740,13 @@ new_ssl_name: ngx_add_timer(c->read, u->connect_timeout); u->conn_waiting = 1; - u->write_prepare_retvals = ngx_http_lua_ssl_handshake_retval_handler; + u->write_prepare_retvals = ngx_http_lua_tls_handshake_retval_handler; ngx_http_lua_cleanup_pending_operation(coctx); coctx->cleanup = ngx_http_lua_coctx_cleanup; coctx->data = u; - c->ssl->handler = ngx_http_lua_ssl_handshake_handler; + c->ssl->handler = ngx_http_lua_tls_handshake_handler; if (ctx->entered_content_phase) { r->write_event_handler = ngx_http_lua_content_wev_handler; @@ -1799,21 +1755,25 @@ new_ssl_name: r->write_event_handler = ngx_http_core_run_phases; } - return lua_yield(L, 0); + return NGX_AGAIN; + } + + ngx_http_lua_tls_handshake_handler(c); + + if (rc == NGX_ERROR) { + *errmsg = u->error_ret; + + return NGX_ERROR; } - top = lua_gettop(L); - ngx_http_lua_ssl_handshake_handler(c); - return lua_gettop(L) - top; + return NGX_OK; } static void -ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) +ngx_http_lua_tls_handshake_handler(ngx_connection_t *c) { - const char *err; int waiting; - lua_State *L; ngx_int_t rc; ngx_connection_t *dc; /* downstream connection */ ngx_http_request_t *r; @@ -1836,11 +1796,9 @@ ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) waiting = u->conn_waiting; dc = r->connection; - L = u->write_co_ctx->co; if (c->read->timedout) { - lua_pushnil(L); - lua_pushliteral(L, "timeout"); + u->error_ret = "timeout"; goto failed; } @@ -1849,19 +1807,18 @@ ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) } if (c->ssl->handshaked) { - if (u->ssl_verify) { rc = SSL_get_verify_result(c->ssl->connection); if (rc != X509_V_OK) { - lua_pushnil(L); - err = lua_pushfstring(L, "%d: %s", (int) rc, - X509_verify_cert_error_string(rc)); + u->error_ret = X509_verify_cert_error_string(rc); + u->openssl_error_code_ret = rc; llcf = ngx_http_get_module_loc_conf(r, ngx_http_lua_module); if (llcf->log_socket_errors) { - ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua ssl " - "certificate verify error: (%s)", err); + ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua tls " + "certificate verify error: (%d: %s)", + rc, u->error_ret); } goto failed; @@ -1872,12 +1829,11 @@ ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) if (u->ssl_name.len && ngx_ssl_check_host(c, &u->ssl_name) != NGX_OK) { - lua_pushnil(L); - lua_pushliteral(L, "certificate host mismatch"); + u->error_ret = "certificate host mismatch"; llcf = ngx_http_get_module_loc_conf(r, ngx_http_lua_module); if (llcf->log_socket_errors) { - ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua ssl " + ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua tls " "certificate does not match host \"%V\"", &u->ssl_name); } @@ -1892,7 +1848,7 @@ ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) ngx_http_lua_socket_handle_conn_success(r, u); } else { - (void) ngx_http_lua_ssl_handshake_retval_handler(r, u, L); + (void) ngx_http_lua_tls_handshake_retval_handler(r, u, NULL); } if (waiting) { @@ -1902,60 +1858,84 @@ ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) return; } - lua_pushnil(L); - lua_pushliteral(L, "handshake failed"); + u->error_ret = "handshake failed"; failed: if (waiting) { u->write_prepare_retvals = - ngx_http_lua_socket_conn_error_retval_handler; - ngx_http_lua_socket_handle_conn_error(r, u, - NGX_HTTP_LUA_SOCKET_FT_SSL); + ngx_http_lua_socket_conn_error_retval_handler; + ngx_http_lua_socket_handle_conn_error(r, u, NGX_HTTP_LUA_SOCKET_FT_SSL); ngx_http_run_posted_requests(dc); } else { - (void) ngx_http_lua_socket_conn_error_retval_handler(r, u, L); + u->ft_type |= NGX_HTTP_LUA_SOCKET_FT_SSL; + + (void) ngx_http_lua_socket_conn_error_retval_handler(r, u, NULL); + } +} + + + +int +ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result(ngx_http_request_t *r, + ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t **sess, + const char **errmsg, int *openssl_error_code) +{ + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, + "lua cosocket get TLS handshake result for upstream: %p", u); + + if (u->error_ret != NULL) { + *errmsg = u->error_ret; + *openssl_error_code = u->openssl_error_code_ret; + + return NGX_ERROR; } + + *sess = u->ssl_session_ret; + + return NGX_OK; } static int -ngx_http_lua_ssl_handshake_retval_handler(ngx_http_request_t *r, +ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L) { ngx_connection_t *c; - ngx_ssl_session_t *ssl_session, **ud; + ngx_ssl_session_t *ssl_session; if (!u->ssl_session_reuse) { - lua_pushboolean(L, 1); - return 1; + return 0; } - ud = lua_newuserdata(L, sizeof(ngx_ssl_session_t *)); - c = u->peer.connection; ssl_session = ngx_ssl_get_session(c); if (ssl_session == NULL) { - *ud = NULL; + u->ssl_session_ret = NULL; } else { - *ud = ssl_session; + u->ssl_session_ret = ssl_session; ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, - "lua ssl save session: %p", ssl_session); - - /* set up the __gc metamethod */ - lua_pushlightuserdata(L, ngx_http_lua_lightudata_mask( - ssl_session_metatable_key)); - lua_rawget(L, LUA_REGISTRYINDEX); - lua_setmetatable(L, -2); + "lua tls save session: %p", ssl_session); } - return 1; + return 0; +} + + +void +ngx_http_lua_ffi_tls_free_session(ngx_ssl_session_t *sess) +{ + ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0, + "lua tls free session: %p", sess); + + ngx_ssl_free_session(sess); } + #endif /* NGX_HTTP_SSL */ @@ -2008,12 +1988,14 @@ ngx_http_lua_socket_prepare_error_retvals(ngx_http_request_t *r, u_char errstr[NGX_MAX_ERROR_STR]; u_char *p; - if (ft_type & (NGX_HTTP_LUA_SOCKET_FT_RESOLVER - | NGX_HTTP_LUA_SOCKET_FT_SSL)) - { + if (ft_type & NGX_HTTP_LUA_SOCKET_FT_RESOLVER) { return 2; } + if (ft_type & NGX_HTTP_LUA_SOCKET_FT_SSL) { + return 0; + } + lua_pushnil(L); if (ft_type & NGX_HTTP_LUA_SOCKET_FT_TIMEOUT) { @@ -6101,27 +6083,6 @@ ngx_http_lua_coctx_cleanup(void *data) } -#if (NGX_HTTP_SSL) - -static int -ngx_http_lua_ssl_free_session(lua_State *L) -{ - ngx_ssl_session_t **psession; - - psession = lua_touserdata(L, 1); - if (psession && *psession != NULL) { - ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0, - "lua ssl free session: %p", *psession); - - ngx_ssl_free_session(*psession); - } - - return 0; -} - -#endif /* NGX_HTTP_SSL */ - - void ngx_http_lua_cleanup_conn_pools(lua_State *L) { diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.h b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.h index a0a5a518..ee9411bc 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.h +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.h @@ -120,6 +120,9 @@ struct ngx_http_lua_socket_tcp_upstream_s { #if (NGX_HTTP_SSL) ngx_str_t ssl_name; + ngx_ssl_session_t *ssl_session_ret; + const char *error_ret; + int openssl_error_code_ret; #endif unsigned ft_type:16; -- 2.32.0 (Apple Git-132) From f5ba21d6f742e6b169d972a81b6124b27c076016 Mon Sep 17 00:00:00 2001 From: Datong Sun Date: Wed, 18 Sep 2019 16:54:32 -0700 Subject: [PATCH 05/17] change: better error when request context couldn't be found. --- src/ngx_http_lua_socket_tcp.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 4ef22c11..abd487fa 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -1627,13 +1627,7 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module); if (ctx == NULL) { - ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, - "no ngx_lua ctx found while TLS handshaking"); - - ngx_http_lua_assert(NULL); - - *errmsg = "no ctx found"; - return NGX_ERROR; + return NGX_HTTP_LUA_FFI_NO_REQ_CTX; } coctx = ctx->cur_co_ctx; -- 2.32.0 (Apple Git-132) From 78a450d571febf7ba918ecc13369144925d02bcb Mon Sep 17 00:00:00 2001 From: Datong Sun Date: Wed, 18 Sep 2019 17:24:07 -0700 Subject: [PATCH 06/17] feature: TCP cosocket client certificate support. closes #534 --- src/ngx_http_lua_socket_tcp.c | 60 +++++++++++++++++++++++++++++++---- 1 file changed, 54 insertions(+), 6 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index abd487fa..61671b70 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -22,7 +22,6 @@ static int ngx_http_lua_socket_tcp(lua_State *L); static int ngx_http_lua_socket_tcp_connect(lua_State *L); #if (NGX_HTTP_SSL) -static int ngx_http_lua_socket_tcp_sslhandshake(lua_State *L); static void ngx_http_lua_tls_handshake_handler(ngx_connection_t *c); static int ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L); @@ -219,9 +218,6 @@ static char ngx_http_lua_upstream_udata_metatable_key; static char ngx_http_lua_downstream_udata_metatable_key; static char ngx_http_lua_pool_udata_metatable_key; static char ngx_http_lua_pattern_udata_metatable_key; -#if (NGX_HTTP_SSL) -static char ngx_http_lua_ssl_session_metatable_key; -#endif #define ngx_http_lua_tcp_socket_metatable_literal_key "__tcp_cosocket_mt" @@ -1563,13 +1559,16 @@ int ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t *sess, int enable_session_reuse, ngx_str_t *server_name, int verify, - int ocsp_status_req, const char **errmsg) + int ocsp_status_req, STACK_OF(X509) *chain, EVP_PKEY *pkey, + const char **errmsg) { - ngx_int_t rc; + ngx_int_t rc, i; ngx_connection_t *c; ngx_http_lua_ctx_t *ctx; ngx_http_lua_co_ctx_t *coctx; const char *busy_rc; + ngx_ssl_conn_t *ssl_conn; + X509 *x509; ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "lua tcp socket tls handshake"); @@ -1625,6 +1624,8 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, return NGX_ERROR; } + ssl_conn = c->ssl->connection; + ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module); if (ctx == NULL) { return NGX_HTTP_LUA_FFI_NO_REQ_CTX; @@ -1647,6 +1648,53 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, u->ssl_session_reuse = enable_session_reuse; } + if (chain != NULL) { + ngx_http_lua_assert(pkey != NULL); /* ensured by resty.core */ + + if (sk_X509_num(chain) < 1) { + ERR_clear_error(); + *errmsg = "invalid client certificate chain"; + return NGX_ERROR; + } + + x509 = sk_X509_value(chain, 0); + if (x509 == NULL) { + ERR_clear_error(); + *errmsg = "lua tls fetch client certificate from chain failed"; + return NGX_ERROR; + } + + if (SSL_use_certificate(ssl_conn, x509) == 0) { + ERR_clear_error(); + *errmsg = "lua tls set client certificate failed"; + return NGX_ERROR; + } + + /* read rest of the chain */ + + for (i = 1; i < sk_X509_num(chain); i++) { + x509 = sk_X509_value(chain, i); + if (x509 == NULL) { + ERR_clear_error(); + *errmsg = "lua tls fetch client intermediate certificate " + "from chain failed"; + return NGX_ERROR; + } + + if (SSL_add1_chain_cert(ssl_conn, x509) == 0) { + ERR_clear_error(); + *errmsg = "lua tls set client intermediate certificate failed"; + return NGX_ERROR; + } + } + + if (SSL_use_PrivateKey(ssl_conn, pkey) == 0) { + ERR_clear_error(); + *errmsg = "lua ssl set client private key failed"; + return NGX_ERROR; + } + } + if (server_name != NULL && server_name->data != NULL) { ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, "lua tls server name: \"%V\"", server_name); -- 2.32.0 (Apple Git-132) From 6cc0c89e946ef42adfbc55e8a461ccc2f367254a Mon Sep 17 00:00:00 2001 From: Datong Sun Date: Wed, 18 Sep 2019 17:25:20 -0700 Subject: [PATCH 07/17] style: style fixes. --- src/ngx_http_lua_socket_tcp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 61671b70..a7d410c9 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -1736,7 +1736,8 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, if (u->ssl_name.len >= server_name->len) { /* reuse it */ - ngx_memcpy(u->ssl_name.data, server_name->data, server_name->len); + ngx_memcpy(u->ssl_name.data, server_name->data, + server_name->len); u->ssl_name.len = server_name->len; } else { -- 2.32.0 (Apple Git-132) From 21cd7779252732a02fa0e596b66a1d4663d2fd64 Mon Sep 17 00:00:00 2001 From: Thibault Charbonnier Date: Mon, 6 Jan 2020 17:56:10 -0800 Subject: [PATCH 08/17] cleanup --- src/ngx_http_lua_socket_tcp.c | 24 +++++++++++------------- 1 file changed, 11 insertions(+), 13 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index a7d410c9..bd7cc7ca 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -1555,6 +1555,7 @@ ngx_http_lua_socket_tcp_check_busy(ngx_http_request_t *r, return NULL; } + int ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t *sess, @@ -1596,7 +1597,7 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, } if (u->raw_downstream || u->body_downstream) { - *errmsg = "not supported for downstream"; + *errmsg = "not supported for downstream sockets"; return NGX_ERROR; } @@ -1637,7 +1638,7 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, if (sess != NULL) { if (ngx_ssl_set_session(c, sess) != NGX_OK) { - *errmsg = "lua tls set session failed"; + *errmsg = "tls set session failed"; return NGX_ERROR; } @@ -1660,13 +1661,13 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, x509 = sk_X509_value(chain, 0); if (x509 == NULL) { ERR_clear_error(); - *errmsg = "lua tls fetch client certificate from chain failed"; + *errmsg = "tls fetch client certificate from chain failed"; return NGX_ERROR; } if (SSL_use_certificate(ssl_conn, x509) == 0) { ERR_clear_error(); - *errmsg = "lua tls set client certificate failed"; + *errmsg = "tls set client certificate failed"; return NGX_ERROR; } @@ -1676,21 +1677,21 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, x509 = sk_X509_value(chain, i); if (x509 == NULL) { ERR_clear_error(); - *errmsg = "lua tls fetch client intermediate certificate " - "from chain failed"; + *errmsg = "tls fetch client intermediate certificate from " + "chain failed"; return NGX_ERROR; } if (SSL_add1_chain_cert(ssl_conn, x509) == 0) { ERR_clear_error(); - *errmsg = "lua tls set client intermediate certificate failed"; + *errmsg = "tls set client intermediate certificate failed"; return NGX_ERROR; } } if (SSL_use_PrivateKey(ssl_conn, pkey) == 0) { ERR_clear_error(); - *errmsg = "lua ssl set client private key failed"; + *errmsg = "tls set client private key failed"; return NGX_ERROR; } } @@ -1709,7 +1710,7 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, } #else - *errmsg = "OpenSSL has no SNI support"; + *errmsg = "no TLS extension support"; return NGX_ERROR; #endif } @@ -1752,7 +1753,6 @@ new_ssl_name: u->ssl_name.data = ngx_alloc(server_name->len, ngx_cycle->log); if (u->ssl_name.data == NULL) { u->ssl_name.len = 0; - *errmsg = "no memory"; return NGX_ERROR; } @@ -1773,7 +1773,7 @@ new_ssl_name: rc = ngx_ssl_handshake(c); ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "ngx_ssl_handshake returned %d", rc); + "ngx_ssl_handshake returned: %d", rc); if (rc == NGX_AGAIN) { if (c->write->timer_set) { @@ -1805,7 +1805,6 @@ new_ssl_name: if (rc == NGX_ERROR) { *errmsg = u->error_ret; - return NGX_ERROR; } @@ -1919,7 +1918,6 @@ failed: } - int ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t **sess, -- 2.32.0 (Apple Git-132) From 0bcf4d1a955db9218e8b0e50685c1d0de8c90b9a Mon Sep 17 00:00:00 2001 From: Datong Sun Date: Tue, 24 Nov 2020 01:49:28 -0800 Subject: [PATCH 09/17] fixed style according to @spacewander's review --- src/ngx_http_lua_socket_tcp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index bd7cc7ca..1aa37627 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -1536,15 +1536,15 @@ static const char * ngx_http_lua_socket_tcp_check_busy(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, unsigned int ops) { - if (ops & SOCKET_OP_CONNECT && u->conn_waiting) { + if ((ops & SOCKET_OP_CONNECT) && u->conn_waiting) { return "socket busy connecting"; } - if (ops & SOCKET_OP_READ && u->read_waiting) { + if ((ops & SOCKET_OP_READ) && u->read_waiting) { return "socket busy reading"; } - if (ops & SOCKET_OP_WRITE + if ((ops & SOCKET_OP_WRITE) && (u->write_waiting || (u->raw_downstream && (r->connection->buffered & NGX_HTTP_LOWLEVEL_BUFFERED)))) -- 2.32.0 (Apple Git-132) From 9b010940f77bbd486c1192eed23af7c35baf4cdb Mon Sep 17 00:00:00 2001 From: chronolaw Date: Fri, 21 Jan 2022 13:42:06 +0800 Subject: [PATCH 10/17] resize tcp_socket_metatable to 7 --- src/ngx_http_lua_socket_tcp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 1aa37627..7cdc45c4 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -160,6 +160,8 @@ enum { SOCKET_CONNECT_TIMEOUT_INDEX = 2, SOCKET_SEND_TIMEOUT_INDEX = 4, SOCKET_READ_TIMEOUT_INDEX = 5, + SOCKET_CLIENT_CERT_INDEX = 6, + SOCKET_CLIENT_KEY_INDEX = 7, }; @@ -424,7 +426,7 @@ ngx_http_lua_socket_tcp(lua_State *L) ngx_http_lua_check_context(L, ctx, NGX_HTTP_LUA_CONTEXT_YIELDABLE); - lua_createtable(L, 5 /* narr */, 1 /* nrec */); + lua_createtable(L, 7 /* narr */, 1 /* nrec */); lua_pushlightuserdata(L, ngx_http_lua_lightudata_mask( tcp_socket_metatable_key)); lua_rawget(L, LUA_REGISTRYINDEX); -- 2.32.0 (Apple Git-132) From 36245613be1031b22b0e6b2eec398dac288fe9a5 Mon Sep 17 00:00:00 2001 From: chronolaw Date: Fri, 21 Jan 2022 14:12:13 +0800 Subject: [PATCH 11/17] change errms tls to ssl --- src/ngx_http_lua_socket_tcp.c | 24 ++++++++++++------------ 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 7cdc45c4..af986364 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -1574,7 +1574,7 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, X509 *x509; ngx_log_debug0(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "lua tcp socket tls handshake"); + "lua tcp socket ssl handshake"); if (u == NULL || u->peer.connection == NULL @@ -1640,12 +1640,12 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, if (sess != NULL) { if (ngx_ssl_set_session(c, sess) != NGX_OK) { - *errmsg = "tls set session failed"; + *errmsg = "ssl set session failed"; return NGX_ERROR; } ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, - "lua tls set session: %p", sess); + "lua ssl set session: %p", sess); } else { u->ssl_session_reuse = enable_session_reuse; @@ -1663,13 +1663,13 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, x509 = sk_X509_value(chain, 0); if (x509 == NULL) { ERR_clear_error(); - *errmsg = "tls fetch client certificate from chain failed"; + *errmsg = "ssl fetch client certificate from chain failed"; return NGX_ERROR; } if (SSL_use_certificate(ssl_conn, x509) == 0) { ERR_clear_error(); - *errmsg = "tls set client certificate failed"; + *errmsg = "ssl set client certificate failed"; return NGX_ERROR; } @@ -1679,28 +1679,28 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, x509 = sk_X509_value(chain, i); if (x509 == NULL) { ERR_clear_error(); - *errmsg = "tls fetch client intermediate certificate from " + *errmsg = "ssl fetch client intermediate certificate from " "chain failed"; return NGX_ERROR; } if (SSL_add1_chain_cert(ssl_conn, x509) == 0) { ERR_clear_error(); - *errmsg = "tls set client intermediate certificate failed"; + *errmsg = "ssl set client intermediate certificate failed"; return NGX_ERROR; } } if (SSL_use_PrivateKey(ssl_conn, pkey) == 0) { ERR_clear_error(); - *errmsg = "tls set client private key failed"; + *errmsg = "ssl set client private key failed"; return NGX_ERROR; } } if (server_name != NULL && server_name->data != NULL) { ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "lua tls server name: \"%V\"", server_name); + "lua ssl server name: \"%V\"", server_name); #ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME if (SSL_set_tlsext_host_name(c->ssl->connection, @@ -1926,7 +1926,7 @@ ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result(ngx_http_request_t *r, const char **errmsg, int *openssl_error_code) { ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0, - "lua cosocket get TLS handshake result for upstream: %p", u); + "lua cosocket get SSL handshake result for upstream: %p", u); if (u->error_ret != NULL) { *errmsg = u->error_ret; @@ -1962,7 +1962,7 @@ ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, u->ssl_session_ret = ssl_session; ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0, - "lua tls save session: %p", ssl_session); + "lua ssl save session: %p", ssl_session); } return 0; @@ -1973,7 +1973,7 @@ void ngx_http_lua_ffi_tls_free_session(ngx_ssl_session_t *sess) { ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0, - "lua tls free session: %p", sess); + "lua ssl free session: %p", sess); ngx_ssl_free_session(sess); } -- 2.32.0 (Apple Git-132) From 1f12b89485da6b7ac5dd23810bf094f214dc324e Mon Sep 17 00:00:00 2001 From: chronolaw Date: Fri, 21 Jan 2022 14:38:49 +0800 Subject: [PATCH 12/17] rename function name from tls to ssl --- src/ngx_http_lua_socket_tcp.c | 28 ++++++++++++++-------------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index af986364..76e98597 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -22,8 +22,8 @@ static int ngx_http_lua_socket_tcp(lua_State *L); static int ngx_http_lua_socket_tcp_connect(lua_State *L); #if (NGX_HTTP_SSL) -static void ngx_http_lua_tls_handshake_handler(ngx_connection_t *c); -static int ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, +static void ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c); +static int ngx_http_lua_ssl_handshake_retval_handler(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L); #endif static int ngx_http_lua_socket_tcp_receive(lua_State *L); @@ -1559,7 +1559,7 @@ ngx_http_lua_socket_tcp_check_busy(ngx_http_request_t *r, int -ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, +ngx_http_lua_ffi_socket_tcp_sslhandshake(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t *sess, int enable_session_reuse, ngx_str_t *server_name, int verify, int ocsp_status_req, STACK_OF(X509) *chain, EVP_PKEY *pkey, @@ -1614,7 +1614,7 @@ ngx_http_lua_ffi_socket_tcp_tlshandshake(ngx_http_request_t *r, u->ssl_session_reuse = enable_session_reuse; - (void) ngx_http_lua_tls_handshake_retval_handler(r, u, NULL); + (void) ngx_http_lua_ssl_handshake_retval_handler(r, u, NULL); return NGX_OK; } @@ -1785,13 +1785,13 @@ new_ssl_name: ngx_add_timer(c->read, u->connect_timeout); u->conn_waiting = 1; - u->write_prepare_retvals = ngx_http_lua_tls_handshake_retval_handler; + u->write_prepare_retvals = ngx_http_lua_ssl_handshake_retval_handler; ngx_http_lua_cleanup_pending_operation(coctx); coctx->cleanup = ngx_http_lua_coctx_cleanup; coctx->data = u; - c->ssl->handler = ngx_http_lua_tls_handshake_handler; + c->ssl->handler = ngx_http_lua_ssl_handshake_handler; if (ctx->entered_content_phase) { r->write_event_handler = ngx_http_lua_content_wev_handler; @@ -1803,7 +1803,7 @@ new_ssl_name: return NGX_AGAIN; } - ngx_http_lua_tls_handshake_handler(c); + ngx_http_lua_ssl_handshake_handler(c); if (rc == NGX_ERROR) { *errmsg = u->error_ret; @@ -1815,7 +1815,7 @@ new_ssl_name: static void -ngx_http_lua_tls_handshake_handler(ngx_connection_t *c) +ngx_http_lua_ssl_handshake_handler(ngx_connection_t *c) { int waiting; ngx_int_t rc; @@ -1860,7 +1860,7 @@ ngx_http_lua_tls_handshake_handler(ngx_connection_t *c) llcf = ngx_http_get_module_loc_conf(r, ngx_http_lua_module); if (llcf->log_socket_errors) { - ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua tls " + ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua ssl " "certificate verify error: (%d: %s)", rc, u->error_ret); } @@ -1877,7 +1877,7 @@ ngx_http_lua_tls_handshake_handler(ngx_connection_t *c) llcf = ngx_http_get_module_loc_conf(r, ngx_http_lua_module); if (llcf->log_socket_errors) { - ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua tls " + ngx_log_error(NGX_LOG_ERR, dc->log, 0, "lua ssl " "certificate does not match host \"%V\"", &u->ssl_name); } @@ -1892,7 +1892,7 @@ ngx_http_lua_tls_handshake_handler(ngx_connection_t *c) ngx_http_lua_socket_handle_conn_success(r, u); } else { - (void) ngx_http_lua_tls_handshake_retval_handler(r, u, NULL); + (void) ngx_http_lua_ssl_handshake_retval_handler(r, u, NULL); } if (waiting) { @@ -1921,7 +1921,7 @@ failed: int -ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result(ngx_http_request_t *r, +ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, ngx_ssl_session_t **sess, const char **errmsg, int *openssl_error_code) { @@ -1942,7 +1942,7 @@ ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result(ngx_http_request_t *r, static int -ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, +ngx_http_lua_ssl_handshake_retval_handler(ngx_http_request_t *r, ngx_http_lua_socket_tcp_upstream_t *u, lua_State *L) { ngx_connection_t *c; @@ -1970,7 +1970,7 @@ ngx_http_lua_tls_handshake_retval_handler(ngx_http_request_t *r, void -ngx_http_lua_ffi_tls_free_session(ngx_ssl_session_t *sess) +ngx_http_lua_ffi_ssl_free_session(ngx_ssl_session_t *sess) { ngx_log_debug1(NGX_LOG_DEBUG_HTTP, ngx_cycle->log, 0, "lua ssl free session: %p", sess); -- 2.32.0 (Apple Git-132) From 84242561aa54ffed3bfab433cfef6f7797e01a47 Mon Sep 17 00:00:00 2001 From: chronolaw Date: Fri, 21 Jan 2022 14:46:38 +0800 Subject: [PATCH 13/17] rename to SOCKET_CLIENT_PRIV_INDEX --- src/ngx_http_lua_socket_tcp.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 76e98597..90da45fc 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -160,8 +160,8 @@ enum { SOCKET_CONNECT_TIMEOUT_INDEX = 2, SOCKET_SEND_TIMEOUT_INDEX = 4, SOCKET_READ_TIMEOUT_INDEX = 5, - SOCKET_CLIENT_CERT_INDEX = 6, - SOCKET_CLIENT_KEY_INDEX = 7, + SOCKET_CLIENT_CERT_INDEX = 6, + SOCKET_CLIENT_PRIV_INDEX = 7, }; -- 2.32.0 (Apple Git-132) From 555166646c525167f9e1e5bb81b6cb100a4834f9 Mon Sep 17 00:00:00 2001 From: chronolaw Date: Fri, 21 Jan 2022 14:49:18 +0800 Subject: [PATCH 14/17] rename to SOCKET_CLIENT_PKEY_INDEX --- src/ngx_http_lua_socket_tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 90da45fc..494486de 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -161,7 +161,7 @@ enum { SOCKET_SEND_TIMEOUT_INDEX = 4, SOCKET_READ_TIMEOUT_INDEX = 5, SOCKET_CLIENT_CERT_INDEX = 6, - SOCKET_CLIENT_PRIV_INDEX = 7, + SOCKET_CLIENT_PKEY_INDEX = 7, }; -- 2.32.0 (Apple Git-132) From e9b54c43c05b064b831fe67d0e0aaff45b2ec505 Mon Sep 17 00:00:00 2001 From: chronolaw Date: Fri, 21 Jan 2022 17:17:09 +0800 Subject: [PATCH 15/17] need not to change tcp_socket_metatable --- src/ngx_http_lua_socket_tcp.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 494486de..152d8cbd 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -160,8 +160,6 @@ enum { SOCKET_CONNECT_TIMEOUT_INDEX = 2, SOCKET_SEND_TIMEOUT_INDEX = 4, SOCKET_READ_TIMEOUT_INDEX = 5, - SOCKET_CLIENT_CERT_INDEX = 6, - SOCKET_CLIENT_PKEY_INDEX = 7, }; @@ -426,7 +424,7 @@ ngx_http_lua_socket_tcp(lua_State *L) ngx_http_lua_check_context(L, ctx, NGX_HTTP_LUA_CONTEXT_YIELDABLE); - lua_createtable(L, 7 /* narr */, 1 /* nrec */); + lua_createtable(L, 5 /* narr */, 1 /* nrec */); lua_pushlightuserdata(L, ngx_http_lua_lightudata_mask( tcp_socket_metatable_key)); lua_rawget(L, LUA_REGISTRYINDEX); -- 2.32.0 (Apple Git-132) From 6c47356ddc327a8692260bd6f43ea67cf2787a73 Mon Sep 17 00:00:00 2001 From: chronolaw Date: Wed, 26 Jan 2022 19:55:29 +0800 Subject: [PATCH 16/17] increase nrec to 3 in the socket object --- src/ngx_http_lua_socket_tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 152d8cbd..8d71f8b4 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -424,7 +424,7 @@ ngx_http_lua_socket_tcp(lua_State *L) ngx_http_lua_check_context(L, ctx, NGX_HTTP_LUA_CONTEXT_YIELDABLE); - lua_createtable(L, 5 /* narr */, 1 /* nrec */); + lua_createtable(L, 5 /* narr */, 3 /* nrec */); lua_pushlightuserdata(L, ngx_http_lua_lightudata_mask( tcp_socket_metatable_key)); lua_rawget(L, LUA_REGISTRYINDEX); -- 2.32.0 (Apple Git-132) From 1d538552c7629310d850d4360408ddb555afcbcc Mon Sep 17 00:00:00 2001 From: chronolaw Date: Sat, 29 Jan 2022 09:18:52 +0800 Subject: [PATCH 17/17] change tcp_socket_metatable nrec to 15 --- src/ngx_http_lua_socket_tcp.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c index 8d71f8b4..5dcdef0e 100644 --- a/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c +++ b/ngx_lua-0.10.20/src/ngx_http_lua_socket_tcp.c @@ -312,7 +312,7 @@ ngx_http_lua_inject_socket_tcp_api(ngx_log_t *log, lua_State *L) /* {{{tcp object metatable */ lua_pushlightuserdata(L, ngx_http_lua_lightudata_mask( tcp_socket_metatable_key)); - lua_createtable(L, 0 /* narr */, 14 /* nrec */); + lua_createtable(L, 0 /* narr */, 15 /* nrec */); lua_pushcfunction(L, ngx_http_lua_socket_tcp_connect); lua_setfield(L, -2, "connect"); -- 2.32.0 (Apple Git-132)