Skip to content

Commit 1cf8f97

Browse files
willmafhwillmafh
committed
Merge branch 'master' into proxy_ssl_certificate_by_lua
2 parents baa159f + 13ba02a commit 1cf8f97

3 files changed

Lines changed: 106 additions & 10 deletions

File tree

‎src/ngx_http_lua_proxy_ssl_verifyby.c‎

Lines changed: 92 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,13 +33,20 @@ ngx_int_t
3333
ngx_http_lua_proxy_ssl_verify_set_callback(ngx_conf_t *cf)
3434
{
3535

36-
#ifdef LIBRESSL_VERSION_NUMBER
36+
#if defined(LIBRESSL_VERSION_NUMBER)
3737

3838
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
3939
"LibreSSL does not support by proxy_ssl_verify_by_lua*");
4040

4141
return NGX_ERROR;
4242

43+
#elif defined(OPENSSL_IS_BORINGSSL)
44+
45+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
46+
"BoringSSL does not support by proxy_ssl_verify_by_lua*");
47+
48+
return NGX_ERROR;
49+
4350
#else
4451

4552
void *plcf;
@@ -150,6 +157,22 @@ char *
150157
ngx_http_lua_proxy_ssl_verify_by_lua(ngx_conf_t *cf, ngx_command_t *cmd,
151158
void *conf)
152159
{
160+
#if defined(LIBRESSL_VERSION_NUMBER)
161+
162+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
163+
"LibreSSL does not support by proxy_ssl_verify_by_lua*");
164+
165+
return NGX_CONF_ERROR;
166+
167+
#elif defined(OPENSSL_IS_BORINGSSL)
168+
169+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
170+
"BoringSSL does not support by proxy_ssl_verify_by_lua*");
171+
172+
return NGX_CONF_ERROR;
173+
174+
#else
175+
153176
#if (!defined SSL_ERROR_WANT_RETRY_VERIFY \
154177
|| OPENSSL_VERSION_NUMBER < 0x30000020L)
155178

@@ -231,12 +254,30 @@ ngx_http_lua_proxy_ssl_verify_by_lua(ngx_conf_t *cf, ngx_command_t *cmd,
231254
return NGX_CONF_OK;
232255

233256
#endif /* SSL_ERROR_WANT_RETRY_VERIFY */
257+
258+
#endif
234259
}
235260

236261

237262
int
238263
ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
239264
{
265+
#if defined(LIBRESSL_VERSION_NUMBER)
266+
267+
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
268+
"LibreSSL does not support by proxy_ssl_verify_by_lua*");
269+
270+
return 1;
271+
272+
#elif defined(OPENSSL_IS_BORINGSSL)
273+
274+
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
275+
"BoringSSL does not support by proxy_ssl_verify_by_lua*");
276+
277+
return 1;
278+
279+
#else
280+
240281
lua_State *L;
241282
ngx_int_t rc;
242283
ngx_connection_t *c;
@@ -377,6 +418,8 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
377418
}
378419

379420
return 0; /* verify failure or error */
421+
422+
#endif
380423
}
381424

382425

@@ -553,6 +596,20 @@ int
553596
ngx_http_lua_ffi_proxy_ssl_set_verify_result(ngx_http_request_t *r,
554597
int verify_result, char **err)
555598
{
599+
#if defined(LIBRESSL_VERSION_NUMBER)
600+
601+
*err = "LibreSSL does not support this function";
602+
603+
return NGX_ERROR;
604+
605+
#elif defined(OPENSSL_IS_BORINGSSL)
606+
607+
*err = "BoringSSL does not support this function";
608+
609+
return NGX_ERROR;
610+
611+
#else
612+
556613
#ifdef SSL_ERROR_WANT_RETRY_VERIFY
557614
ngx_http_upstream_t *u;
558615
ngx_ssl_conn_t *ssl_conn;
@@ -598,12 +655,28 @@ ngx_http_lua_ffi_proxy_ssl_set_verify_result(ngx_http_request_t *r,
598655

599656
return NGX_ERROR;
600657
#endif
658+
659+
#endif
601660
}
602661

603662

604663
int
605664
ngx_http_lua_ffi_proxy_ssl_get_verify_result(ngx_http_request_t *r, char **err)
606665
{
666+
#if defined(LIBRESSL_VERSION_NUMBER)
667+
668+
*err = "LibreSSL does not support this function";
669+
670+
return NGX_ERROR;
671+
672+
#elif defined(OPENSSL_IS_BORINGSSL)
673+
674+
*err = "BoringSSL does not support this function";
675+
676+
return NGX_ERROR;
677+
678+
#else
679+
607680
#ifdef SSL_ERROR_WANT_RETRY_VERIFY
608681
ngx_http_upstream_t *u;
609682
ngx_ssl_conn_t *ssl_conn;
@@ -647,6 +720,8 @@ ngx_http_lua_ffi_proxy_ssl_get_verify_result(ngx_http_request_t *r, char **err)
647720

648721
return NGX_ERROR;
649722
#endif
723+
724+
#endif
650725
}
651726

652727

@@ -662,6 +737,20 @@ ngx_http_lua_ffi_proxy_ssl_free_verify_cert(void *cdata)
662737
void *
663738
ngx_http_lua_ffi_proxy_ssl_get_verify_cert(ngx_http_request_t *r, char **err)
664739
{
740+
#if defined(LIBRESSL_VERSION_NUMBER)
741+
742+
*err = "LibreSSL does not support this function";
743+
744+
return NGX_ERROR;
745+
746+
#elif defined(OPENSSL_IS_BORINGSSL)
747+
748+
*err = "BoringSSL does not support this function";
749+
750+
return NGX_ERROR;
751+
752+
#else
753+
665754
#ifdef SSL_ERROR_WANT_RETRY_VERIFY
666755
ngx_http_upstream_t *u;
667756
ngx_ssl_conn_t *ssl_conn;
@@ -713,6 +802,8 @@ ngx_http_lua_ffi_proxy_ssl_get_verify_cert(ngx_http_request_t *r, char **err)
713802

714803
return NULL;
715804
#endif
805+
806+
#endif
716807
}
717808

718809

‎src/ngx_http_lua_ssl_client_helloby.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -220,7 +220,7 @@ ngx_http_lua_ssl_client_hello_handler(ngx_ssl_conn_t *ssl_conn,
220220

221221
dd("first time");
222222

223-
#if (nginx_version > 1029000)
223+
#if (nginx_version > 1029001)
224224
/* see commit 0373fe5d98c1515640 for more details */
225225
rc = ngx_ssl_client_hello_callback(ssl_conn, al, arg);
226226

‎t/169-proxy-ssl-verify.t‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,19 @@ repeat_each(3);
88
my $NginxBinary = $ENV{'TEST_NGINX_BINARY'} || 'nginx';
99
my $openssl_version = eval { `$NginxBinary -V 2>&1` };
1010

11-
if ($openssl_version =~ m/built with OpenSSL (0\S*|1\.0\S*|1\.1\.0\S*)/) {
12-
plan(skip_all => "too old OpenSSL, need 1.1.1, was $1");
11+
if ($openssl_version =~ m/built with OpenSSL (\d+)\.(\d+)\.(\d+)/) {
12+
my ($major, $minor, $patch) = ($1, $2, $3);
13+
14+
if ($major < 3 || ($major == 3 && $minor == 0 && $patch < 2)) {
15+
plan(skip_all => "too old OpenSSL, need >= 3.0.2, was " .
16+
"$major.$minor.$patch");
17+
} else {
18+
plan tests => repeat_each() * (blocks() * 5 + 19);
19+
}
1320
} elsif ($openssl_version =~ m/running with BoringSSL/) {
1421
plan(skip_all => "does not support BoringSSL");
15-
} elsif ($ENV{TEST_NGINX_USE_HTTP3}) {
16-
plan tests => repeat_each() * (blocks() * 6 + 6);
1722
} else {
18-
plan tests => repeat_each() * (blocks() * 5 + 10);
23+
die "unknown SSL";
1924
}
2025

2126
$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
@@ -1230,7 +1235,7 @@ proxy_ssl_verify_by_lua: cert verify callback aborted
12301235
=== TEST 25: cosocket
12311236
--- http_config
12321237
server {
1233-
listen *:80;
1238+
listen 127.0.0.1:$TEST_NGINX_RAND_PORT_1;
12341239
server_name test.com;
12351240

12361241
server_tokens off;
@@ -1279,7 +1284,7 @@ proxy_ssl_verify_by_lua: cert verify callback aborted
12791284
local sock = ngx.socket.tcp()
12801285
sock:settimeout(2000)
12811286

1282-
local ok, err = sock:connect("127.0.0.1", "80")
1287+
local ok, err = sock:connect("127.0.0.1", $TEST_NGINX_RAND_PORT_1)
12831288
if not ok then
12841289
ngx.log(ngx.ERR, "failed to connect: ", err)
12851290
return
@@ -1320,7 +1325,7 @@ simple logging return
13201325
connected: 1
13211326
sent http request: 56 bytes.
13221327
received: HTTP/1.1 201 Created
1323-
received: Server: openresty
1328+
received: Server: nginx
13241329
received: Content-Type: text/plain
13251330
received: Content-Length: 4
13261331
received: Connection: close

0 commit comments

Comments
 (0)