Skip to content

Commit 9a07206

Browse files
committed
bugfix: remove sslhandshake result assert for pre-handshake errors.
When `tcpsock:sslhandshake()` fails before the actual SSL handshake starts, `ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result()` may return `FFI_OK` while still providing the OpenSSL error details. One example is a client private key setup failure. In that path, `rc` is `FFI_ERROR`, but `u->error_ret` is not set, so `ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result` would return `FFI_OK`. The existing `assert(res == FFI_ERROR)` turns this expected error-reporting path into an assertion failure. This patch removes the assertion so Lua can return the original SSL error to the caller.
1 parent 90fb633 commit 9a07206

1 file changed

Lines changed: 1 addition & 3 deletions

File tree

lib/resty/core/socket.lua

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -427,11 +427,9 @@ local function sslhandshake(cosocket, reused_session, server_name, ssl_verify,
427427
local res
428428

429429
if rc == FFI_ERROR then
430-
res = C.ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(r, u,
430+
C.ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(r, u,
431431
session_ptr, errmsg, openssl_error_code)
432432

433-
assert(res == FFI_ERROR)
434-
435433
if openssl_error_code[0] ~= 0 then
436434
return nil, openssl_error_code[0] .. ": " .. ffi_str(errmsg[0])
437435
end

0 commit comments

Comments
 (0)