Skip to content

Commit dc3a1bf

Browse files
catbro666catbro666
authored
feature: add lua_ssl_conf_command directive for setting arbitrary Ope… (#252)
1 parent 7930446 commit dc3a1bf

File tree

4 files changed

+307
-2
lines changed

4 files changed

+307
-2
lines changed

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,7 @@ behavior.
160160
* [lua_ssl_protocols](https://github.com/openresty/lua-nginx-module#lua_ssl_protocols)
161161
* [lua_ssl_trusted_certificate](https://github.com/openresty/lua-nginx-module#lua_ssl_trusted_certificate)
162162
* [lua_ssl_verify_depth](https://github.com/openresty/lua-nginx-module#lua_ssl_verify_depth)
163+
* [lua_ssl_conf_command](https://github.com/openresty/lua-nginx-module#lua_ssl_conf_command)
163164
* [lua_check_client_abort](https://github.com/openresty/lua-nginx-module#lua_check_client_abort)
164165
* [lua_max_pending_timers](https://github.com/openresty/lua-nginx-module#lua_max_pending_timers)
165166
* [lua_max_running_timers](https://github.com/openresty/lua-nginx-module#lua_max_running_timers)

‎src/ngx_stream_lua_common.h‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -249,6 +249,9 @@ struct ngx_stream_lua_srv_conf_s {
249249
ngx_uint_t ssl_verify_depth;
250250
ngx_str_t ssl_trusted_certificate;
251251
ngx_str_t ssl_crl;
252+
#if (nginx_version >= 1019004)
253+
ngx_array_t *ssl_conf_commands;
254+
#endif
252255

253256
struct {
254257
ngx_stream_lua_srv_conf_handler_pt ssl_cert_handler;

‎src/ngx_stream_lua_module.c‎

Lines changed: 39 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,14 +48,23 @@ static char *ngx_stream_lua_lowat_check(ngx_conf_t *cf, void *post, void *data);
4848
#if (NGX_STREAM_SSL)
4949
static ngx_int_t ngx_stream_lua_set_ssl(ngx_conf_t *cf,
5050
ngx_stream_lua_loc_conf_t *llcf);
51+
#if (nginx_version >= 1019004)
52+
static char *ngx_stream_lua_ssl_conf_command_check(ngx_conf_t *cf, void *post,
53+
void *data);
54+
#endif
5155
#endif
5256
static char *ngx_stream_lua_malloc_trim(ngx_conf_t *cf, ngx_command_t *cmd,
5357
void *conf);
5458

5559

5660
static ngx_conf_post_t ngx_stream_lua_lowat_post =
5761
{ ngx_stream_lua_lowat_check };
58-
62+
#if (NGX_STREAM_SSL)
63+
#if (nginx_version >= 1019004)
64+
static ngx_conf_post_t ngx_stream_lua_ssl_conf_command_post =
65+
{ ngx_stream_lua_ssl_conf_command_check };
66+
#endif
67+
#endif
5968

6069

6170

@@ -412,6 +421,14 @@ static ngx_command_t ngx_stream_lua_cmds[] = {
412421
offsetof(ngx_stream_lua_srv_conf_t, ssl_crl),
413422
NULL },
414423

424+
#if (nginx_version >= 1019004)
425+
{ ngx_string("lua_ssl_conf_command"),
426+
NGX_STREAM_MAIN_CONF|NGX_STREAM_SRV_CONF|NGX_CONF_TAKE2,
427+
ngx_conf_set_keyval_slot,
428+
NGX_STREAM_SRV_CONF_OFFSET,
429+
offsetof(ngx_stream_lua_srv_conf_t, ssl_conf_commands),
430+
&ngx_stream_lua_ssl_conf_command_post },
431+
#endif
415432
#endif /* NGX_STREAM_SSL */
416433

417434
{ ngx_string("lua_malloc_trim"),
@@ -854,6 +871,10 @@ ngx_stream_lua_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
854871
ngx_conf_merge_str_value(conf->ssl_trusted_certificate,
855872
prev->ssl_trusted_certificate, "");
856873
ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
874+
#if (nginx_version >= 1019004)
875+
ngx_conf_merge_ptr_value(conf->ssl_conf_commands, prev->ssl_conf_commands,
876+
NULL);
877+
#endif
857878

858879
if (ngx_stream_lua_set_ssl(cf, conf) != NGX_OK) {
859880
return NGX_CONF_ERROR;
@@ -951,9 +972,26 @@ ngx_stream_lua_set_ssl(ngx_conf_t *cf, ngx_stream_lua_srv_conf_t *lscf)
951972
return NGX_ERROR;
952973
}
953974

975+
#if (nginx_version >= 1019004)
976+
if (ngx_ssl_conf_commands(cf, lscf->ssl, lscf->ssl_conf_commands)
977+
!= NGX_OK) {
978+
return NGX_ERROR;
979+
}
980+
#endif
954981
return NGX_OK;
955982
}
956983

984+
#if (nginx_version >= 1019004)
985+
static char *
986+
ngx_stream_lua_ssl_conf_command_check(ngx_conf_t *cf, void *post, void *data)
987+
{
988+
#ifndef SSL_CONF_FLAG_FILE
989+
return "is not supported on this platform";
990+
#endif
991+
992+
return NGX_CONF_OK;
993+
}
994+
#endif
957995
#endif /* NGX_STREAM_SSL */
958996

959997

‎t/129-ssl-socket.t‎

Lines changed: 264 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ use File::Basename;
66

77
repeat_each(2);
88

9-
plan tests => repeat_each() * 216;
9+
plan tests => repeat_each() * (blocks() * 7 + 2);
1010

1111
$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
1212
$ENV{TEST_NGINX_MEMCACHED_PORT} ||= 11211;
@@ -2487,3 +2487,266 @@ lua ssl certificate verify error: (18: self signed certificate)
24872487
SSL reused session
24882488
[alert]
24892489
--- timeout: 5
2490+
2491+
2492+
2493+
=== TEST 32: default cipher - TLSv1.3
2494+
--- skip_openssl: 8: < 1.1.1
2495+
--- http_config
2496+
server {
2497+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
2498+
server_name test.com;
2499+
ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
2500+
ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
2501+
ssl_protocols TLSv1.3;
2502+
2503+
location / {
2504+
content_by_lua_block {
2505+
ngx.exit(200)
2506+
}
2507+
}
2508+
}
2509+
--- stream_server_config
2510+
lua_ssl_protocols TLSv1.3;
2511+
2512+
content_by_lua_block {
2513+
local sock = ngx.socket.tcp()
2514+
sock:settimeout(2000)
2515+
2516+
do
2517+
local ok, err = sock:connect("unix:$TEST_NGINX_HTML_DIR/nginx.sock")
2518+
if not ok then
2519+
ngx.say("failed to connect: ", err)
2520+
return
2521+
end
2522+
2523+
ngx.say("connected: ", ok)
2524+
2525+
local session, err = sock:sslhandshake(nil, "test.com")
2526+
if not session then
2527+
ngx.say("failed to do SSL handshake: ", err)
2528+
return
2529+
end
2530+
2531+
ngx.say("ssl handshake: ", type(session))
2532+
2533+
local req = "GET / HTTP/1.1\r\nHost: test.com\r\nConnection: close\r\n\r\n"
2534+
local bytes, err = sock:send(req)
2535+
if not bytes then
2536+
ngx.say("failed to send stream request: ", err)
2537+
return
2538+
end
2539+
2540+
ngx.say("sent stream request: ", bytes, " bytes.")
2541+
2542+
local line, err = sock:receive()
2543+
if not line then
2544+
ngx.say("failed to recieve response status line: ", err)
2545+
return
2546+
end
2547+
2548+
ngx.say("received: ", line)
2549+
2550+
local ok, err = sock:close()
2551+
ngx.say("close: ", ok, " ", err)
2552+
end -- do
2553+
collectgarbage()
2554+
}
2555+
2556+
--- stream_response
2557+
connected: 1
2558+
ssl handshake: userdata
2559+
sent stream request: 53 bytes.
2560+
received: HTTP/1.1 200 OK
2561+
close: 1 nil
2562+
2563+
--- log_level: debug
2564+
--- grep_error_log eval: qr/lua ssl (?:set|save|free) session: [0-9A-F]+/
2565+
--- grep_error_log_out eval
2566+
qr/^lua ssl save session: ([0-9A-F]+)
2567+
lua ssl free session: ([0-9A-F]+)
2568+
$/
2569+
--- error_log eval
2570+
[
2571+
'lua ssl server name: "test.com"',
2572+
qr/SSL: TLSv1.3, cipher: "TLS_AES_256_GCM_SHA384 TLSv1.3/,
2573+
]
2574+
--- no_error_log
2575+
SSL reused session
2576+
[error]
2577+
[alert]
2578+
--- timeout: 10
2579+
2580+
2581+
2582+
=== TEST 33: explicit cipher configuration - TLSv1.3
2583+
--- skip_openssl: 8: < 1.1.1
2584+
--- skip_nginx: 8: < 1.19.4
2585+
--- http_config
2586+
server {
2587+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
2588+
server_name test.com;
2589+
ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
2590+
ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
2591+
ssl_protocols TLSv1.3;
2592+
2593+
location / {
2594+
content_by_lua_block {
2595+
ngx.exit(200)
2596+
}
2597+
}
2598+
}
2599+
--- stream_server_config
2600+
lua_ssl_protocols TLSv1.3;
2601+
lua_ssl_conf_command Ciphersuites TLS_AES_128_GCM_SHA256;
2602+
2603+
content_by_lua_block {
2604+
local sock = ngx.socket.tcp()
2605+
sock:settimeout(2000)
2606+
2607+
do
2608+
local ok, err = sock:connect("unix:$TEST_NGINX_HTML_DIR/nginx.sock")
2609+
if not ok then
2610+
ngx.say("failed to connect: ", err)
2611+
return
2612+
end
2613+
2614+
ngx.say("connected: ", ok)
2615+
2616+
local session, err = sock:sslhandshake(nil, "test.com")
2617+
if not session then
2618+
ngx.say("failed to do SSL handshake: ", err)
2619+
return
2620+
end
2621+
2622+
ngx.say("ssl handshake: ", type(session))
2623+
2624+
local req = "GET / HTTP/1.1\r\nHost: test.com\r\nConnection: close\r\n\r\n"
2625+
local bytes, err = sock:send(req)
2626+
if not bytes then
2627+
ngx.say("failed to send stream request: ", err)
2628+
return
2629+
end
2630+
2631+
ngx.say("sent stream request: ", bytes, " bytes.")
2632+
2633+
local line, err = sock:receive()
2634+
if not line then
2635+
ngx.say("failed to recieve response status line: ", err)
2636+
return
2637+
end
2638+
2639+
ngx.say("received: ", line)
2640+
2641+
local ok, err = sock:close()
2642+
ngx.say("close: ", ok, " ", err)
2643+
end -- do
2644+
collectgarbage()
2645+
}
2646+
2647+
--- stream_response
2648+
connected: 1
2649+
ssl handshake: userdata
2650+
sent stream request: 53 bytes.
2651+
received: HTTP/1.1 200 OK
2652+
close: 1 nil
2653+
2654+
--- log_level: debug
2655+
--- grep_error_log eval: qr/lua ssl (?:set|save|free) session: [0-9A-F]+/
2656+
--- grep_error_log_out eval
2657+
qr/^lua ssl save session: ([0-9A-F]+)
2658+
lua ssl free session: ([0-9A-F]+)
2659+
$/
2660+
--- error_log eval
2661+
['lua ssl server name: "test.com"',
2662+
qr/SSL: TLSv1.3, cipher: "TLS_AES_128_GCM_SHA256 TLSv1.3/]
2663+
--- no_error_log
2664+
SSL reused session
2665+
[error]
2666+
[alert]
2667+
--- timeout: 10
2668+
2669+
2670+
2671+
=== TEST 34: explicit cipher configuration not in the default list - TLSv1.3
2672+
--- skip_openssl: 8: < 1.1.1
2673+
--- skip_nginx: 8: < 1.19.4
2674+
--- http_config
2675+
server {
2676+
listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
2677+
server_name test.com;
2678+
ssl_certificate $TEST_NGINX_CERT_DIR/cert/test.crt;
2679+
ssl_certificate_key $TEST_NGINX_CERT_DIR/cert/test.key;
2680+
ssl_protocols TLSv1.3;
2681+
2682+
location / {
2683+
content_by_lua_block {
2684+
ngx.exit(200)
2685+
}
2686+
}
2687+
}
2688+
--- stream_server_config
2689+
lua_ssl_protocols TLSv1.3;
2690+
lua_ssl_conf_command Ciphersuites TLS_AES_128_CCM_SHA256;
2691+
2692+
content_by_lua_block {
2693+
local sock = ngx.socket.tcp()
2694+
sock:settimeout(2000)
2695+
2696+
do
2697+
local ok, err = sock:connect("unix:$TEST_NGINX_HTML_DIR/nginx.sock")
2698+
if not ok then
2699+
ngx.say("failed to connect: ", err)
2700+
return
2701+
end
2702+
2703+
ngx.say("connected: ", ok)
2704+
2705+
local session, err = sock:sslhandshake(nil, "test.com")
2706+
if not session then
2707+
ngx.say("failed to do SSL handshake: ", err)
2708+
return
2709+
end
2710+
2711+
ngx.say("ssl handshake: ", type(session))
2712+
2713+
local req = "GET / HTTP/1.1\r\nHost: test.com\r\nConnection: close\r\n\r\n"
2714+
local bytes, err = sock:send(req)
2715+
if not bytes then
2716+
ngx.say("failed to send stream request: ", err)
2717+
return
2718+
end
2719+
2720+
ngx.say("sent stream request: ", bytes, " bytes.")
2721+
2722+
local line, err = sock:receive()
2723+
if not line then
2724+
ngx.say("failed to recieve response status line: ", err)
2725+
return
2726+
end
2727+
2728+
ngx.say("received: ", line)
2729+
2730+
local ok, err = sock:close()
2731+
ngx.say("close: ", ok, " ", err)
2732+
end -- do
2733+
collectgarbage()
2734+
}
2735+
2736+
--- stream_response
2737+
connected: 1
2738+
failed to do SSL handshake: handshake failed
2739+
2740+
--- log_level: debug
2741+
--- grep_error_log eval: qr/lua ssl (?:set|save|free) session: [0-9A-F]+/
2742+
--- grep_error_log_out
2743+
--- error_log eval
2744+
[
2745+
qr/\[info\] .*?SSL_do_handshake\(\) failed .*?no shared cipher/,
2746+
'lua ssl server name: "test.com"',
2747+
]
2748+
--- no_error_log
2749+
SSL reused session
2750+
[alert]
2751+
[emerg]
2752+
--- timeout: 10

0 commit comments

Comments
 (0)