feat: add server random and master key fetch api

Author: mengxiangwei

src/api/ngx_http_lua_api.h

@@ -19,7 +19,7 @@
 /* Public API for other Nginx modules */
 
 
-#define ngx_http_lua_version  10029
+#define ngx_http_lua_version  10030
 #define NGX_HTTP_LUA_EXPORT_CO_CTX_CLEANUP 1
 
 

src/ngx_http_lua_initworkerby.c

@@ -115,6 +115,19 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle)
 
     ngx_memcpy(fake_cycle, cycle, sizeof(ngx_cycle_t));
 
+    /*
+     * nginx clears cycle->old_cycle after ngx_init_cycle() completes.
+     * Since nginx 1.29.2, ngx_ssl_cache_fetch() accesses old_cycle->conf_ctx
+     * without a NULL guard, so we must ensure old_cycle is non-NULL.
+     * This avoids a NULL dereference when merge_loc_conf triggers
+     * ngx_ssl_trusted_certificate.
+     * Pointing to the current cycle is safe: the SSL cache is shared via
+     * conf_ctx, so cert lookups still find previously loaded entries.
+     */
+    if (fake_cycle->old_cycle == NULL) {
+        fake_cycle->old_cycle = cycle;
+    }
+
     ngx_queue_init(&fake_cycle->reusable_connections_queue);
 
     if (ngx_array_init(&fake_cycle->listening, cycle->pool,

src/ngx_http_lua_ssl_certby.c

@@ -1754,4 +1754,54 @@ ngx_http_lua_ffi_ssl_client_random(ngx_http_request_t *r,
 }
 
 
+int
+ngx_http_lua_ffi_ssl_server_random(ngx_http_request_t *r,
+    unsigned char *out, size_t *outlen, char **err)
+{
+    ngx_ssl_conn_t          *ssl_conn;
+
+    if (r->connection == NULL || r->connection->ssl == NULL) {
+        *err = "bad request";
+        return NGX_ERROR;
+    }
+
+    ssl_conn = r->connection->ssl->connection;
+    if (ssl_conn == NULL) {
+        *err = "bad ssl conn";
+        return NGX_ERROR;
+    }
+
+    *outlen = SSL_get_server_random(ssl_conn, out, *outlen);
+
+    return NGX_OK;
+}
+
+
+int
+ngx_http_lua_ffi_ssl_session_master_key(ngx_http_request_t *r,
+    unsigned char *out, size_t *outlen, char **err)
+{
+    ngx_ssl_conn_t          *ssl_conn;
+    SSL_SESSION             *sess;
+
+    if (r->connection == NULL || r->connection->ssl == NULL) {
+        *err = "bad request";
+        return NGX_ERROR;
+    }
+
+    ssl_conn = r->connection->ssl->connection;
+    if (ssl_conn == NULL) {
+        *err = "bad ssl conn";
+        return NGX_ERROR;
+    }
+
+    sess = SSL_get0_session(ssl_conn);
+
+
+    *outlen = SSL_SESSION_get_master_key(sess, out, *outlen);
+
+    return NGX_OK;
+}
+
+
 #endif /* NGX_HTTP_SSL */

t/138-balancer.t

@@ -698,6 +698,7 @@ hello world: HTTP/2.0
 --- no_error_log
 [error]
 [crit]
+--- skip_nginx: 4: < 1.29.4
 
 
 
@@ -736,3 +737,4 @@ qr/502 Bad Gateway/
 [error]
 --- error_log eval
 qr/SSL_do_handshake.*(?:no application protocol|NO_APPLICATION_PROTOCOL).*SSL alert number 120\) while SSL handshaking to upstream/
+--- skip_nginx: 4: < 1.29.4