Skip to content

Commit 566df41

Browse files
willmafhzhuizhuhaomeng
willmafh
authored and
zhuizhuhaomeng
committed
feature: proxy_ssl_certificate_by_lua directives
1 parent 56b858d commit 566df41

16 files changed

Lines changed: 2410 additions & 11 deletions

‎README.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -151,6 +151,8 @@ behavior.
151151
* [ssl_client_hello_by_lua_file](https://github.com/openresty/lua-nginx-module#ssl_client_hello_by_lua_file)
152152
* [ssl_certificate_by_lua_block](https://github.com/openresty/lua-nginx-module#ssl_certificate_by_lua_block)
153153
* [ssl_certificate_by_lua_file](https://github.com/openresty/lua-nginx-module#ssl_certificate_by_lua_file)
154+
* [proxy_ssl_certificate_by_lua_block](https://github.com/openresty/lua-nginx-module#proxy_ssl_certificate_by_lua_block)
155+
* [proxy_ssl_certificate_by_lua_file](https://github.com/openresty/lua-nginx-module#proxy_ssl_certificate_by_lua_file)
154156
* [proxy_ssl_verify_by_lua_block](https://github.com/openresty/lua-nginx-module#proxy_ssl_verify_by_lua_block)
155157
* [proxy_ssl_verify_by_lua_file](https://github.com/openresty/lua-nginx-module#proxy_ssl_verify_by_lua_file)
156158
* [lua_shared_dict](https://github.com/openresty/lua-nginx-module#lua_shared_dict)

‎config‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -278,6 +278,7 @@ STREAM_LUA_SRCS=" \
278278
$ngx_addon_dir/src/ngx_stream_lua_semaphore.c \
279279
$ngx_addon_dir/src/ngx_stream_lua_ssl_client_helloby.c \
280280
$ngx_addon_dir/src/ngx_stream_lua_ssl_certby.c \
281+
$ngx_addon_dir/src/ngx_stream_lua_proxy_ssl_certby.c \
281282
$ngx_addon_dir/src/ngx_stream_lua_proxy_ssl_verifyby.c \
282283
$ngx_addon_dir/src/ngx_stream_lua_log_ringbuf.c \
283284
$ngx_addon_dir/src/ngx_stream_lua_input_filters.c \
@@ -323,6 +324,7 @@ STREAM_LUA_DEPS=" \
323324
$ngx_addon_dir/src/ngx_stream_lua_semaphore.h \
324325
$ngx_addon_dir/src/ngx_stream_lua_ssl_client_helloby.h \
325326
$ngx_addon_dir/src/ngx_stream_lua_ssl_certby.h \
327+
$ngx_addon_dir/src/ngx_stream_lua_proxy_ssl_certby.h \
326328
$ngx_addon_dir/src/ngx_stream_lua_proxy_ssl_verifyby.h \
327329
$ngx_addon_dir/src/ngx_stream_lua_log_ringbuf.h \
328330
$ngx_addon_dir/src/ngx_stream_lua_input_filters.h \

‎src/ngx_stream_lua_common.h‎

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -135,10 +135,8 @@
135135
#define NGX_STREAM_LUA_CONTEXT_PREREAD 0x0020
136136
#define NGX_STREAM_LUA_CONTEXT_SSL_CERT 0x0040
137137
#define NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO 0x0080
138-
139-
#ifdef HAVE_PROXY_SSL_PATCH
140138
#define NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY 0x0100
141-
#endif
139+
#define NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT 0x0200
142140

143141

144142
#define NGX_STREAM_LUA_FFI_NO_REQ_CTX -100
@@ -277,6 +275,10 @@ struct ngx_stream_lua_srv_conf_s {
277275

278276
#ifdef HAVE_PROXY_SSL_PATCH
279277
struct {
278+
ngx_stream_lua_srv_conf_handler_pt proxy_ssl_cert_handler;
279+
ngx_str_t proxy_ssl_cert_src;
280+
u_char *proxy_ssl_cert_src_key;
281+
280282
ngx_stream_lua_srv_conf_handler_pt proxy_ssl_verify_handler;
281283
ngx_str_t proxy_ssl_verify_src;
282284
u_char *proxy_ssl_verify_src_key;

‎src/ngx_stream_lua_control.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ ngx_stream_lua_ffi_exit(ngx_stream_lua_request_t *r, int status, u_char *err,
117117
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
118118
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
119119
#ifdef HAVE_PROXY_SSL_PATCH
120+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT
120121
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
121122
#endif
122123
| NGX_STREAM_LUA_CONTEXT_PREREAD,
@@ -127,6 +128,7 @@ ngx_stream_lua_ffi_exit(ngx_stream_lua_request_t *r, int status, u_char *err,
127128

128129
if (ctx->context & (NGX_STREAM_LUA_CONTEXT_SSL_CERT
129130
#ifdef HAVE_PROXY_SSL_PATCH
131+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT
130132
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
131133
#endif
132134
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO ))

‎src/ngx_stream_lua_coroutine.c‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,6 +206,7 @@ ngx_stream_lua_coroutine_resume(lua_State *L)
206206
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
207207
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
208208
#ifdef HAVE_PROXY_SSL_PATCH
209+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT
209210
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
210211
#endif
211212
| NGX_STREAM_LUA_CONTEXT_PREREAD
@@ -270,6 +271,7 @@ ngx_stream_lua_coroutine_yield(lua_State *L)
270271
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
271272
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
272273
#ifdef HAVE_PROXY_SSL_PATCH
274+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT
273275
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
274276
#endif
275277
| NGX_STREAM_LUA_CONTEXT_PREREAD
@@ -433,6 +435,7 @@ ngx_stream_lua_coroutine_status(lua_State *L)
433435
| NGX_STREAM_LUA_CONTEXT_SSL_CLIENT_HELLO
434436
| NGX_STREAM_LUA_CONTEXT_SSL_CERT
435437
#ifdef HAVE_PROXY_SSL_PATCH
438+
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT
436439
| NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY
437440
#endif
438441
| NGX_STREAM_LUA_CONTEXT_PREREAD

‎src/ngx_stream_lua_module.c‎

Lines changed: 36 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,11 @@
3030
#include "ngx_stream_lua_semaphore.h"
3131
#include "ngx_stream_lua_ssl_client_helloby.h"
3232
#include "ngx_stream_lua_ssl_certby.h"
33+
34+
#ifdef HAVE_PROXY_SSL_PATCH
35+
#include "ngx_stream_lua_proxy_ssl_certby.h"
3336
#include "ngx_stream_lua_proxy_ssl_verifyby.h"
37+
#endif
3438

3539
#include "ngx_stream_lua_prereadby.h"
3640

@@ -429,8 +433,22 @@ static ngx_command_t ngx_stream_lua_cmds[] = {
429433
0,
430434
(void *) ngx_stream_lua_ssl_cert_handler_file },
431435

432-
#if HAVE_LUA_PROXY_SSL_VERIFY
436+
#if HAVE_PROXY_SSL_PATCH
433437
/* same context as proxy_pass directive */
438+
{ ngx_string("proxy_ssl_certificate_by_lua_block"),
439+
NGX_STREAM_SRV_CONF|NGX_CONF_BLOCK|NGX_CONF_NOARGS,
440+
ngx_stream_lua_proxy_ssl_cert_by_lua_block,
441+
NGX_STREAM_SRV_CONF_OFFSET,
442+
0,
443+
(void *) ngx_stream_lua_proxy_ssl_cert_handler_inline },
444+
445+
{ ngx_string("proxy_ssl_certificate_by_lua_file"),
446+
NGX_STREAM_SRV_CONF|NGX_CONF_TAKE1,
447+
ngx_stream_lua_proxy_ssl_cert_by_lua,
448+
NGX_STREAM_SRV_CONF_OFFSET,
449+
0,
450+
(void *) ngx_stream_lua_proxy_ssl_cert_handler_file },
451+
434452
{ ngx_string("proxy_ssl_verify_by_lua_block"),
435453
NGX_STREAM_SRV_CONF|NGX_CONF_BLOCK|NGX_CONF_NOARGS,
436454
ngx_stream_lua_proxy_ssl_verify_by_lua_block,
@@ -858,6 +876,10 @@ ngx_stream_lua_create_srv_conf(ngx_conf_t *cf)
858876
* lscf->srv.ssl_client_hello_src = { 0, NULL };
859877
* lscf->srv.ssl_client_hello_src_key = NULL;
860878
*
879+
* lscf->ups.proxy_ssl_cert_handler = NULL;
880+
* lscf->ups.proxy_ssl_cert_src = { 0, NULL };
881+
* lscf->ups.proxy_ssl_cert_src_key = NULL;
882+
*
861883
* lscf->ups.proxy_ssl_verify_handler = NULL;
862884
* lscf->ups.proxy_ssl_verify_src = { 0, NULL };
863885
* lscf->ups.proxy_ssl_verify_src_key = NULL;
@@ -1039,7 +1061,19 @@ ngx_stream_lua_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
10391061
NULL);
10401062
#endif
10411063

1042-
#if HAVE_LUA_PROXY_SSL_VERIFY
1064+
#ifdef HAVE_PROXY_SSL_PATCH
1065+
if (conf->ups.proxy_ssl_cert_src.len == 0) {
1066+
conf->ups.proxy_ssl_cert_src = prev->ups.proxy_ssl_cert_src;
1067+
conf->ups.proxy_ssl_cert_handler = prev->ups.proxy_ssl_cert_handler;
1068+
conf->ups.proxy_ssl_cert_src_key = prev->ups.proxy_ssl_cert_src_key;
1069+
}
1070+
1071+
if (conf->ups.proxy_ssl_cert_src.len) {
1072+
if (ngx_stream_lua_proxy_ssl_cert_set_callback(cf) != NGX_OK) {
1073+
return NGX_CONF_ERROR;
1074+
}
1075+
}
1076+
10431077
if (conf->ups.proxy_ssl_verify_src.len == 0) {
10441078
conf->ups.proxy_ssl_verify_src = prev->ups.proxy_ssl_verify_src;
10451079
conf->ups.proxy_ssl_verify_handler = prev->ups.proxy_ssl_verify_handler;

‎src/ngx_stream_lua_phase.c‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,10 @@ ngx_stream_lua_ngx_get_phase(lua_State *L)
6767
break;
6868

6969
#ifdef HAVE_PROXY_SSL_PATCH
70+
case NGX_STREAM_LUA_CONTEXT_PROXY_SSL_CERT:
71+
lua_pushliteral(L, "proxy_ssl_cert");
72+
break;
73+
7074
case NGX_STREAM_LUA_CONTEXT_PROXY_SSL_VERIFY:
7175
lua_pushliteral(L, "proxy_ssl_verify");
7276
break;

0 commit comments

Comments
 (0)