Skip to content

Commit 1de837f

Browse files
willmafhwillmafh
committed
refactor: using real request and connection to implement
proxy ssl verify instead of fake request and connection.
1 parent 1a5c4f5 commit 1de837f

File tree

4 files changed

+116
-119
lines changed

4 files changed

+116
-119
lines changed

‎src/ngx_http_lua_proxy_ssl_verifyby.c‎

Lines changed: 68 additions & 111 deletions
Original file line numberDiff line numberDiff line change
@@ -23,8 +23,6 @@
2323

2424
static void ngx_http_lua_proxy_ssl_verify_done(void *data);
2525
static void ngx_http_lua_proxy_ssl_verify_aborted(void *data);
26-
static u_char *ngx_http_lua_log_proxy_ssl_verify_error(ngx_log_t *log,
27-
u_char *buf, size_t len);
2826
static ngx_int_t ngx_http_lua_proxy_ssl_verify_by_chunk(lua_State *L,
2927
ngx_http_request_t *r);
3028

@@ -239,10 +237,9 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
239237
{
240238
lua_State *L;
241239
ngx_int_t rc;
242-
ngx_connection_t *c, *fc;
243-
ngx_http_request_t *r = NULL, *fr = NULL;
240+
ngx_connection_t *c;
241+
ngx_http_request_t *r = NULL;
244242
ngx_pool_cleanup_t *cln;
245-
ngx_http_core_loc_conf_t *clcf;
246243
ngx_http_lua_loc_conf_t *llcf;
247244
ngx_http_lua_ctx_t *ctx;
248245
ngx_http_lua_ssl_ctx_t *cctx;
@@ -252,7 +249,7 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
252249
ssl_conn = X509_STORE_CTX_get_ex_data(x509_store,
253250
SSL_get_ex_data_X509_STORE_CTX_idx());
254251

255-
c = ngx_ssl_get_connection(ssl_conn); /* connection to upstream */
252+
c = ngx_ssl_get_connection(ssl_conn); /* upstream connection */
256253

257254
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, c->log, 0,
258255
"proxy ssl verify: connection reusable: %ud", c->reusable);
@@ -285,51 +282,6 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
285282

286283
r = c->data;
287284

288-
fc = ngx_http_lua_create_fake_connection(NULL);
289-
if (fc == NULL) {
290-
goto failed;
291-
}
292-
293-
fc->log->handler = ngx_http_lua_log_proxy_ssl_verify_error;
294-
fc->log->data = fc;
295-
296-
fc->addr_text = c->addr_text;
297-
fc->listening = c->listening;
298-
299-
fr = ngx_http_lua_create_fake_request(fc);
300-
if (fr == NULL) {
301-
goto failed;
302-
}
303-
304-
cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
305-
fr->main_conf = cscf->ctx->main_conf;
306-
fr->srv_conf = cscf->ctx->srv_conf;
307-
/*
308-
* the hook is running after find config phase, and r->loc_conf may
309-
* already been changed, we need to get correct location configs
310-
*/
311-
fr->loc_conf = r->loc_conf;
312-
/*
313-
* so that we can use ngx.ctx to pass data from downstream phases to
314-
* upstream phases if there is any
315-
*/
316-
ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module);
317-
if (ctx) {
318-
ngx_http_set_ctx(fr, ctx, ngx_http_lua_module);
319-
}
320-
321-
fc->log->file = c->log->file;
322-
fc->log->log_level = c->log->log_level;
323-
fc->ssl = c->ssl;
324-
325-
clcf = ngx_http_get_module_loc_conf(fr, ngx_http_core_module);
326-
327-
#if nginx_version >= 1009000
328-
ngx_set_connection_log(fc, clcf->error_log);
329-
#else
330-
ngx_http_set_connection_log(fc, clcf->error_log);
331-
#endif
332-
333285
if (cctx == NULL) {
334286
cctx = ngx_pcalloc(c->pool, sizeof(ngx_http_lua_ssl_ctx_t));
335287
if (cctx == NULL) {
@@ -339,12 +291,17 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
339291
cctx->ctx_ref = LUA_NOREF;
340292
}
341293

342-
cctx->exit_code = 1; /* successful by default */
343-
cctx->x509_store = x509_store;
344294
cctx->connection = c;
345-
cctx->request = fr;
346-
cctx->entered_proxy_ssl_verify_handler = 1;
295+
cctx->request = r;
296+
cctx->x509_store = x509_store;
297+
cctx->exit_code = 1; /* successful by default */
298+
cctx->original_request_count = r->main->count;
347299
cctx->done = 0;
300+
cctx->entered_proxy_ssl_verify_handler = 1;
301+
cctx->pool = ngx_create_pool(128, c->log);
302+
if (cctx->pool == NULL) {
303+
goto failed;
304+
}
348305

349306
dd("setting cctx");
350307

@@ -355,7 +312,7 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
355312
goto failed;
356313
}
357314

358-
llcf = ngx_http_get_module_loc_conf(fr, ngx_http_lua_module);
315+
llcf = ngx_http_get_module_loc_conf(r, ngx_http_lua_module);
359316
if (llcf->upstream_skip_openssl_default_verify == 0) {
360317
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, c->log, 0,
361318
"proxy_ssl_verify_by_lua: openssl default verify");
@@ -367,19 +324,20 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
367324
}
368325

369326
/* TODO honor lua_code_cache off */
370-
L = ngx_http_lua_get_lua_vm(fr, NULL);
327+
L = ngx_http_lua_get_lua_vm(r, NULL);
371328

372329
c->log->action = "loading proxy ssl verify by lua";
373330

374331
if (llcf->proxy_ssl_verify_handler == NULL) {
332+
cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
375333
ngx_log_error(NGX_LOG_ALERT, c->log, 0,
376334
"no proxy_ssl_verify_by_lua* defined in "
377335
"server %V", &cscf->server_name);
378336

379337
goto failed;
380338
}
381339

382-
rc = llcf->proxy_ssl_verify_handler(fr, llcf, L);
340+
rc = llcf->proxy_ssl_verify_handler(r, llcf, L);
383341

384342
if (rc >= NGX_OK || rc == NGX_ERROR) {
385343
cctx->done = 1;
@@ -398,7 +356,7 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
398356

399357
/* rc == NGX_DONE */
400358

401-
cln = ngx_pool_cleanup_add(fc->pool, 0);
359+
cln = ngx_pool_cleanup_add(cctx->pool, 0);
402360
if (cln == NULL) {
403361
goto failed;
404362
}
@@ -421,13 +379,8 @@ ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store, void *arg)
421379
return SSL_set_retry_verify(ssl_conn);
422380

423381
failed:
424-
425-
if (fr && fr->pool) {
426-
ngx_http_lua_free_fake_request(fr);
427-
}
428-
429-
if (fc) {
430-
ngx_http_lua_close_fake_connection(fc);
382+
if (cctx && cctx->pool) {
383+
ngx_destroy_pool(cctx->pool);
431384
}
432385

433386
return 0; /* verify failure or error */
@@ -456,6 +409,14 @@ ngx_http_lua_proxy_ssl_verify_done(void *data)
456409

457410
c = cctx->connection;
458411

412+
if (c->read->timer_set) {
413+
ngx_del_timer(c->read);
414+
}
415+
416+
if (c->write->timer_set) {
417+
ngx_del_timer(c->write);
418+
}
419+
459420
c->log->action = "proxy pass SSL handshaking";
460421

461422
ngx_post_event(c->write, &ngx_posted_events);
@@ -477,45 +438,10 @@ ngx_http_lua_proxy_ssl_verify_aborted(void *data)
477438
ngx_log_debug0(NGX_LOG_DEBUG_HTTP, cctx->connection->log, 0,
478439
"proxy_ssl_verify_by_lua: cert verify callback aborted");
479440

480-
cctx->aborted = 1;
481-
cctx->request->connection->ssl = NULL;
482-
483-
ngx_http_lua_finalize_fake_request(cctx->request, NGX_ERROR);
484-
}
485-
486-
487-
static u_char *
488-
ngx_http_lua_log_proxy_ssl_verify_error(ngx_log_t *log,
489-
u_char *buf, size_t len)
490-
{
491-
u_char *p;
492-
ngx_connection_t *c;
493-
494-
if (log->action) {
495-
p = ngx_snprintf(buf, len, " while %s", log->action);
496-
len -= p - buf;
497-
buf = p;
498-
}
499-
500-
p = ngx_snprintf(buf, len, ", context: proxy_ssl_verify_by_lua*");
501-
len -= p - buf;
502-
buf = p;
441+
ngx_http_lua_finalize_request(cctx->request, NGX_ERROR);
503442

504-
c = log->data;
505-
506-
if (c && c->addr_text.len) {
507-
p = ngx_snprintf(buf, len, ", client: %V", &c->addr_text);
508-
len -= p - buf;
509-
buf = p;
510-
}
511-
512-
if (c && c->listening && c->listening->addr_text.len) {
513-
p = ngx_snprintf(buf, len, ", server: %V", &c->listening->addr_text);
514-
/* len -= p - buf; */
515-
buf = p;
516-
}
517-
518-
return buf;
443+
cctx->aborted = 1;
444+
cctx->connection->ssl = NULL;
519445
}
520446

521447

@@ -527,6 +453,9 @@ ngx_http_lua_proxy_ssl_verify_by_chunk(lua_State *L, ngx_http_request_t *r)
527453
lua_State *co;
528454
ngx_http_lua_ctx_t *ctx;
529455
ngx_pool_cleanup_t *cln;
456+
ngx_http_upstream_t *u;
457+
ngx_connection_t *c;
458+
ngx_http_lua_ssl_ctx_t *cctx;
530459

531460
ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module);
532461

@@ -580,7 +509,11 @@ ngx_http_lua_proxy_ssl_verify_by_chunk(lua_State *L, ngx_http_request_t *r)
580509

581510
/* register request cleanup hooks */
582511
if (ctx->cleanup == NULL) {
583-
cln = ngx_pool_cleanup_add(r->pool, 0);
512+
u = r->upstream;
513+
c = u->peer.connection;
514+
cctx = ngx_http_lua_ssl_get_ctx(c->ssl->connection);
515+
516+
cln = ngx_pool_cleanup_add(cctx->pool, 0);
584517
if (cln == NULL) {
585518
rc = NGX_ERROR;
586519
ngx_http_lua_finalize_request(r, rc);
@@ -625,17 +558,25 @@ ngx_http_lua_ffi_ssl_set_verify_result(ngx_http_request_t *r,
625558
int verify_result, char **err)
626559
{
627560
#ifdef SSL_ERROR_WANT_RETRY_VERIFY
561+
ngx_http_upstream_t *u;
628562
ngx_ssl_conn_t *ssl_conn;
629563
ngx_connection_t *c;
630564
ngx_http_lua_ssl_ctx_t *cctx;
631565
X509_STORE_CTX *x509_store;
632566

633-
if (r->connection == NULL || r->connection->ssl == NULL) {
567+
u = r->upstream;
568+
if (u == NULL) {
634569
*err = "bad request";
635570
return NGX_ERROR;
636571
}
637572

638-
ssl_conn = r->connection->ssl->connection;
573+
c = u->peer.connection;
574+
if (c == NULL || c->ssl == NULL) {
575+
*err = "bad upstream connection";
576+
return NGX_ERROR;
577+
}
578+
579+
ssl_conn = c->ssl->connection;
639580
if (ssl_conn == NULL) {
640581
*err = "bad ssl conn";
641582
return NGX_ERROR;
@@ -668,17 +609,25 @@ int
668609
ngx_http_lua_ffi_ssl_get_verify_result(ngx_http_request_t *r, char **err)
669610
{
670611
#ifdef SSL_ERROR_WANT_RETRY_VERIFY
612+
ngx_http_upstream_t *u;
671613
ngx_ssl_conn_t *ssl_conn;
672614
ngx_connection_t *c;
673615
ngx_http_lua_ssl_ctx_t *cctx;
674616
X509_STORE_CTX *x509_store;
675617

676-
if (r->connection == NULL || r->connection->ssl == NULL) {
618+
u = r->upstream;
619+
if (u == NULL) {
677620
*err = "bad request";
678621
return NGX_ERROR;
679622
}
680623

681-
ssl_conn = r->connection->ssl->connection;
624+
c = u->peer.connection;
625+
if (c == NULL || c->ssl == NULL) {
626+
*err = "bad upstream connection";
627+
return NGX_ERROR;
628+
}
629+
630+
ssl_conn = c->ssl->connection;
682631
if (ssl_conn == NULL) {
683632
*err = "bad ssl conn";
684633
return NGX_ERROR;
@@ -718,18 +667,26 @@ void *
718667
ngx_http_lua_ffi_ssl_get_verify_cert(ngx_http_request_t *r, char **err)
719668
{
720669
#ifdef SSL_ERROR_WANT_RETRY_VERIFY
670+
ngx_http_upstream_t *u;
721671
ngx_ssl_conn_t *ssl_conn;
722672
ngx_connection_t *c;
723673
ngx_http_lua_ssl_ctx_t *cctx;
724674
X509_STORE_CTX *x509_store;
725675
X509 *x509;
726676

727-
if (r->connection == NULL || r->connection->ssl == NULL) {
677+
u = r->upstream;
678+
if (u == NULL) {
728679
*err = "bad request";
729680
return NULL;
730681
}
731682

732-
ssl_conn = r->connection->ssl->connection;
683+
c = u->peer.connection;
684+
if (c == NULL || c->ssl == NULL) {
685+
*err = "bad upstream connection";
686+
return NULL;
687+
}
688+
689+
ssl_conn = c->ssl->connection;
733690
if (ssl_conn == NULL) {
734691
*err = "bad ssl conn";
735692
return NULL;

‎src/ngx_http_lua_ssl.h‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616

1717
typedef struct {
1818
ngx_connection_t *connection; /* original true connection */
19-
ngx_http_request_t *request; /* fake request */
19+
ngx_http_request_t *request;
2020
ngx_pool_cleanup_pt *cleanup;
2121

2222
ngx_ssl_session_t *session; /* return value for openssl's
@@ -25,6 +25,7 @@ typedef struct {
2525
ngx_str_t session_id;
2626

2727
X509_STORE_CTX *x509_store;
28+
ngx_pool_t *pool;
2829

2930
int exit_code; /* exit code for openssl's
3031
set_client_hello_cb or
@@ -35,6 +36,8 @@ typedef struct {
3536
request ctx data in lua
3637
registry */
3738

39+
/* same size as count field of ngx_http_request_t */
40+
unsigned original_request_count:16;
3841
unsigned done:1;
3942
unsigned aborted:1;
4043

0 commit comments

Comments
 (0)