feat: add server random and master key fetch api

Author: mengxiangwei

src/api/ngx_http_lua_api.h

@@ -19,7 +19,7 @@
 /* Public API for other Nginx modules */
 
 
-#define ngx_http_lua_version  10029
+#define ngx_http_lua_version  10030
 #define NGX_HTTP_LUA_EXPORT_CO_CTX_CLEANUP 1
 
 

src/ngx_http_lua_initworkerby.c

@@ -115,6 +115,19 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle)
 
     ngx_memcpy(fake_cycle, cycle, sizeof(ngx_cycle_t));
 
+    /*
+     * nginx clears cycle->old_cycle after ngx_init_cycle() completes.
+     * Since nginx 1.29.2, ngx_ssl_cache_fetch() accesses old_cycle->conf_ctx
+     * without a NULL guard, so we must ensure old_cycle is non-NULL.
+     * This avoids a NULL dereference when merge_loc_conf triggers
+     * ngx_ssl_trusted_certificate.
+     * Pointing to the current cycle is safe: the SSL cache is shared via
+     * conf_ctx, so cert lookups still find previously loaded entries.
+     */
+    if (fake_cycle->old_cycle == NULL) {
+        fake_cycle->old_cycle = cycle;
+    }
+
     ngx_queue_init(&fake_cycle->reusable_connections_queue);
 
     if (ngx_array_init(&fake_cycle->listening, cycle->pool,

t/138-balancer.t

@@ -698,6 +698,7 @@ hello world: HTTP/2.0
 --- no_error_log
 [error]
 [crit]
+--- skip_nginx: 4: < 1.29.4
 
 
 
@@ -736,3 +737,4 @@ qr/502 Bad Gateway/
 [error]
 --- error_log eval
 qr/SSL_do_handshake.*(?:no application protocol|NO_APPLICATION_PROTOCOL).*SSL alert number 120\) while SSL handshaking to upstream/
+--- skip_nginx: 4: < 1.29.4

t/140-ssl-c-api.t

@@ -2089,61 +2089,66 @@ TLSv1.2, cipher: "ECDHE-RSA-AES128-GCM-SHA256 TLSv1.2 Kx=ECDH Au=RSA Enc=AESGCM(
         listen unix:$TEST_NGINX_HTML_DIR/nginx.sock ssl;
         server_name   test.com;
 
-        ssl_certificate_by_lua_block {
-            collectgarbage()
+        ssl_certificate ../../cert/test.crt;
+        ssl_certificate_key ../../cert/test.key;
 
-            local ffi = require "ffi"
-            require "defines"
+        server_tokens off;
+        location /foo {
+            default_type 'text/plain';
+            content_by_lua_block {
+                collectgarbage()
 
-            local errmsg = ffi.new("char *[1]")
+                local ffi = require "ffi"
+                require "defines"
 
-            local r = require "resty.core.base" .get_request()
-            if r == nil then
-                ngx.log(ngx.ERR, "no request found")
-                return
-            end
+                local errmsg = ffi.new("char *[1]")
 
-            -- test server random length
-            local out = ffi.new("unsigned char[?]", 0)
-            local sizep = ffi.new("size_t[1]", 0)
-			
-            local rc = ffi.C.ngx_http_lua_ffi_ssl_server_random(r, out, sizep, errmsg)
-            if rc ~= 0 then
-                ngx.log(ngx.ERR, "failed to get server random length: ",
-                        ffi.string(errmsg[0]))
-                return
-            end
+                local r = require "resty.core.base" .get_request()
+                if r == nil then
+                    ngx.log(ngx.ERR, "no request found")
+                    ngx.status = 201 ngx.say("foo") ngx.exit(201)
+                    return
+                end
 
-            if tonumber(sizep[0]) ~= 32 then
-                ngx.log(ngx.ERR, "server random length does not equal 32")
-                return
-            end
+                -- test server random length
+                local out = ffi.new("unsigned char[?]", 0)
+                local sizep = ffi.new("size_t[1]", 0)
 
-            -- test server random value
-            out = ffi.new("unsigned char[?]", 50)
-            sizep = ffi.new("size_t[1]", 50)
+                local rc = ffi.C.ngx_http_lua_ffi_ssl_server_random(r, out, sizep, errmsg)
+                if rc ~= 0 then
+                    ngx.log(ngx.ERR, "failed to get server random length: ",
+                            ffi.string(errmsg[0]))
+                    ngx.status = 201 ngx.say("foo") ngx.exit(201)
+                    return
+                end
 
-            rc = ffi.C.ngx_http_lua_ffi_ssl_server_random(r, out, sizep, errmsg)
-            if rc ~= 0 then
-                ngx.log(ngx.ERR, "failed to get server random: ",
-                        ffi.string(errmsg[0]))
-                return
-            end
+                if tonumber(sizep[0]) ~= 32 then
+                    ngx.log(ngx.ERR, "server random length does not equal 32")
+                    ngx.status = 201 ngx.say("foo") ngx.exit(201)
+                    return
+                end
 
-            local init_v = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
-            if ffi.string(out, sizep[0]) == init_v then
-                ngx.log(ngx.ERR, "maybe the server random value is incorrect")
-                return
-            end
-        }
+                -- test server random value
+                out = ffi.new("unsigned char[?]", 50)
+                sizep = ffi.new("size_t[1]", 50)
 
-        ssl_certificate ../../cert/test.crt;
-        ssl_certificate_key ../../cert/test.key;
+                rc = ffi.C.ngx_http_lua_ffi_ssl_server_random(r, out, sizep, errmsg)
+                if rc ~= 0 then
+                    ngx.log(ngx.ERR, "failed to get server random: ",
+                            ffi.string(errmsg[0]))
+                    ngx.status = 201 ngx.say("foo") ngx.exit(201)
+                    return
+                end
 
-        server_tokens off;
-        location /foo {
-            default_type 'text/plain';
-            content_by_lua_block { ngx.status = 201 ngx.say("foo") ngx.exit(201) }
+                local init_v = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"
+                if ffi.string(out, sizep[0]) == init_v then
+                    ngx.log(ngx.ERR, "maybe the server random value is incorrect")
+                    ngx.status = 201 ngx.say("foo") ngx.exit(201)
+                    return
+                end
+
+                ngx.status = 201 ngx.say("foo") ngx.exit(201)
+            }
             more_clear_headers Date;
         }
     }

util/build.sh

@@ -37,7 +37,7 @@ time ngx-build $force $version \
           --with-http_ssl_module \
           --add-module=$root/../ndk-nginx-module \
           --add-module=$root/../set-misc-nginx-module \
-          --with-ld-opt="-L$PCRE2_LIB -L$OPENSSL_LIB -Wl,-rpath,$PCRE2_LIB:$LIBDRIZZLE_LIB:$OPENSSL_LIB" \
+          --with-ld-opt="-L$PCRE2_LIB -L$OPENSSL_LIB -L$LUAJIT_LIB -Wl,-rpath,$PCRE2_LIB:$LIBDRIZZLE_LIB:$OPENSSL_LIB:$LUAJIT_LIB" \
           --without-mail_pop3_module \
           --without-mail_imap_module \
           --with-http_image_filter_module \