Skip to content

Commit c4888f8

Browse files
willmafhwillmafh
committed
macro to conditional build proxy ssl verify
1 parent bfdc5a3 commit c4888f8

8 files changed

+122
-3
lines changed

‎src/ngx_http_lua_common.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -148,7 +148,10 @@ typedef struct {
148148
#define NGX_HTTP_LUA_CONTEXT_EXIT_WORKER 0x00002000
149149
#define NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO 0x00004000
150150
#define NGX_HTTP_LUA_CONTEXT_SERVER_REWRITE 0x00008000
151+
152+
#ifdef HAVE_PROXY_SSL_PATCH
151153
#define NGX_HTTP_LUA_CONTEXT_PROXY_SSL_VERIFY 0x00010000
154+
#endif
152155

153156

154157
#define NGX_HTTP_LUA_FFI_NO_REQ_CTX -100
@@ -390,12 +393,15 @@ struct ngx_http_lua_loc_conf_s {
390393
ngx_array_t *ssl_conf_commands;
391394
#endif
392395

396+
#ifdef HAVE_PROXY_SSL_PATCH
393397
ngx_http_lua_loc_conf_handler_pt proxy_ssl_verify_handler;
394398
ngx_str_t proxy_ssl_verify_src;
395399
u_char *proxy_ssl_verify_src_key;
396400
u_char *proxy_ssl_verify_chunkname;
397401
int proxy_ssl_verify_src_ref;
398402
ngx_flag_t upstream_skip_openssl_default_verify;
403+
#endif
404+
399405
#endif
400406

401407
ngx_flag_t force_read_body; /* whether force request body to

‎src/ngx_http_lua_control.c

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -384,7 +384,9 @@ ngx_http_lua_ffi_exit(ngx_http_request_t *r, int status, u_char *err,
384384
| NGX_HTTP_LUA_CONTEXT_TIMER
385385
| NGX_HTTP_LUA_CONTEXT_HEADER_FILTER
386386
| NGX_HTTP_LUA_CONTEXT_BALANCER
387+
#ifdef HAVE_PROXY_SSL_PATCH
387388
| NGX_HTTP_LUA_CONTEXT_PROXY_SSL_VERIFY
389+
#endif
388390
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO
389391
| NGX_HTTP_LUA_CONTEXT_SSL_CERT
390392
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE
@@ -395,8 +397,10 @@ ngx_http_lua_ffi_exit(ngx_http_request_t *r, int status, u_char *err,
395397
return NGX_ERROR;
396398
}
397399

398-
if (ctx->context & (NGX_HTTP_LUA_CONTEXT_PROXY_SSL_VERIFY
399-
| NGX_HTTP_LUA_CONTEXT_SSL_CERT
400+
if (ctx->context & (NGX_HTTP_LUA_CONTEXT_SSL_CERT
401+
#ifdef HAVE_PROXY_SSL_PATCH
402+
| NGX_HTTP_LUA_CONTEXT_PROXY_SSL_VERIFY
403+
#endif
400404
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO
401405
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE
402406
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH))

‎src/ngx_http_lua_module.c

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,11 @@
3131
#include "ngx_http_lua_ssl_certby.h"
3232
#include "ngx_http_lua_ssl_session_storeby.h"
3333
#include "ngx_http_lua_ssl_session_fetchby.h"
34+
35+
#ifdef HAVE_PROXY_SSL_PATCH
3436
#include "ngx_http_lua_proxy_ssl_verifyby.h"
37+
#endif
38+
3539
#include "ngx_http_lua_headers.h"
3640
#include "ngx_http_lua_headers_out.h"
3741
#if !(NGX_WIN32)
@@ -661,6 +665,7 @@ static ngx_command_t ngx_http_lua_cmds[] = {
661665
0,
662666
(void *) ngx_http_lua_ssl_sess_fetch_handler_file },
663667

668+
#ifdef HAVE_PROXY_SSL_PATCH
664669
/* same context as proxy_pass directive */
665670
{ ngx_string("proxy_ssl_verify_by_lua_block"),
666671
NGX_HTTP_LOC_CONF|NGX_HTTP_LIF_CONF|NGX_CONF_BLOCK|NGX_CONF_NOARGS,
@@ -682,6 +687,7 @@ static ngx_command_t ngx_http_lua_cmds[] = {
682687
NGX_HTTP_LOC_CONF_OFFSET,
683688
offsetof(ngx_http_lua_loc_conf_t, upstream_skip_openssl_default_verify),
684689
NULL },
690+
#endif
685691

686692
{ ngx_string("lua_ssl_verify_depth"),
687693
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
@@ -1507,8 +1513,10 @@ ngx_http_lua_create_loc_conf(ngx_conf_t *cf)
15071513
#if (nginx_version >= 1019004)
15081514
conf->ssl_conf_commands = NGX_CONF_UNSET_PTR;
15091515
#endif
1516+
#ifdef HAVE_PROXY_SSL_PATCH
15101517
conf->proxy_ssl_verify_src_ref = LUA_REFNIL;
15111518
conf->upstream_skip_openssl_default_verify = NGX_CONF_UNSET;
1519+
#endif
15121520
#endif
15131521

15141522
return conf;
@@ -1603,6 +1611,7 @@ ngx_http_lua_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
16031611
NULL);
16041612
#endif
16051613

1614+
#ifdef HAVE_PROXY_SSL_PATCH
16061615
if (conf->proxy_ssl_verify_src.len == 0) {
16071616
conf->proxy_ssl_verify_src = prev->proxy_ssl_verify_src;
16081617
conf->proxy_ssl_verify_handler = prev->proxy_ssl_verify_handler;
@@ -1619,6 +1628,7 @@ ngx_http_lua_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
16191628

16201629
ngx_conf_merge_value(conf->upstream_skip_openssl_default_verify,
16211630
prev->upstream_skip_openssl_default_verify, 0);
1631+
#endif
16221632

16231633
if (ngx_http_lua_set_ssl(cf, conf) != NGX_OK) {
16241634
return NGX_CONF_ERROR;

‎src/ngx_http_lua_proxy_ssl_verifyby.c

Lines changed: 41 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,12 @@
1616
#include "ngx_http_lua_util.h"
1717
#include "ngx_http_ssl_module.h"
1818
#include "ngx_http_lua_contentby.h"
19-
#include "ngx_http_lua_proxy_ssl_verifyby.h"
2019
#include "ngx_http_lua_directive.h"
2120
#include "ngx_http_lua_ssl.h"
2221

22+
#ifdef HAVE_PROXY_SSL_PATCH
23+
#include "ngx_http_lua_proxy_ssl_verifyby.h"
24+
2325

2426
static void ngx_http_lua_proxy_ssl_verify_done(void *data);
2527
static void ngx_http_lua_proxy_ssl_verify_aborted(void *data);
@@ -708,4 +710,42 @@ ngx_http_lua_ffi_ssl_get_verify_cert(ngx_http_request_t *r, char **err)
708710
#endif
709711
}
710712

713+
714+
#else /* HAVE_PROXY_SSL_PATCH */
715+
716+
717+
int
718+
ngx_http_lua_ffi_ssl_set_verify_result(ngx_http_request_t *r,
719+
int verify_result, char **err)
720+
{
721+
*err = "Does not have HAVE_PROXY_SSL_PATCH to support this function";
722+
723+
return NGX_ERROR;
724+
}
725+
726+
727+
int
728+
ngx_http_lua_ffi_ssl_get_verify_result(ngx_http_request_t *r, char **err)
729+
{
730+
*err = "Does not have HAVE_PROXY_SSL_PATCH to support this function";
731+
732+
return NGX_ERROR;
733+
}
734+
735+
736+
void
737+
ngx_http_lua_ffi_ssl_free_verify_cert(void *cdata)
738+
{
739+
}
740+
741+
742+
void *
743+
ngx_http_lua_ffi_ssl_get_verify_cert(ngx_http_request_t *r, char **err)
744+
{
745+
*err = "Does not have HAVE_PROXY_SSL_PATCH to support this function";
746+
747+
return NULL;
748+
}
749+
750+
#endif /* HAVE_PROXY_SSL_PATCH */
711751
#endif /* NGX_HTTP_SSL */

‎src/ngx_http_lua_proxy_ssl_verifyby.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@
1010

1111

1212
#if (NGX_HTTP_SSL)
13+
#ifdef HAVE_PROXY_SSL_PATCH
1314

1415
/* do not introduce ngx_http_proxy_module to pollute ngx_http_lua_module.c */
1516
extern ngx_module_t ngx_http_proxy_module;
@@ -31,6 +32,7 @@ int ngx_http_lua_proxy_ssl_verify_handler(X509_STORE_CTX *x509_store,
3132

3233
ngx_int_t ngx_http_lua_proxy_ssl_verify_set_callback(ngx_conf_t *cf);
3334

35+
#endif /* HAVE_PROXY_SSL_PATCH */
3436
#endif /* NGX_HTTP_SSL */
3537

3638

‎src/ngx_http_lua_ssl.h

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,8 +24,10 @@ typedef struct {
2424

2525
ngx_str_t session_id;
2626

27+
#ifdef HAVE_PROXY_SSL_PATCH
2728
X509_STORE_CTX *x509_store;
2829
ngx_pool_t *pool;
30+
#endif
2931

3032
int exit_code; /* exit code for openssl's
3133
set_client_hello_cb or
@@ -36,15 +38,19 @@ typedef struct {
3638
request ctx data in lua
3739
registry */
3840

41+
#ifdef HAVE_PROXY_SSL_PATCH
3942
/* same size as count field of ngx_http_request_t */
4043
unsigned original_request_count:16;
44+
#endif
4145
unsigned done:1;
4246
unsigned aborted:1;
4347

4448
unsigned entered_client_hello_handler:1;
4549
unsigned entered_cert_handler:1;
4650
unsigned entered_sess_fetch_handler:1;
51+
#ifdef HAVE_PROXY_SSL_PATCH
4752
unsigned entered_proxy_ssl_verify_handler:1;
53+
#endif
4854
} ngx_http_lua_ssl_ctx_t;
4955

5056

‎src/ngx_http_lua_util.c

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1682,9 +1682,11 @@ ngx_http_lua_run_thread(lua_State *L, ngx_http_request_t *r,
16821682
NGX_ERROR : NGX_HTTP_INTERNAL_SERVER_ERROR;
16831683

16841684
done:
1685+
#ifdef HAVE_PROXY_SSL_PATCH
16851686
if (ctx->context == NGX_HTTP_LUA_CONTEXT_PROXY_SSL_VERIFY) {
16861687
return NGX_OK;
16871688
}
1689+
#endif
16881690

16891691
if (ctx->entered_content_phase
16901692
&& r->connection->fd != (ngx_socket_t) -1)
@@ -2441,9 +2443,11 @@ ngx_http_lua_handle_exit(lua_State *L, ngx_http_request_t *r,
24412443
return ctx->exit_code;
24422444
}
24432445

2446+
#ifdef HAVE_PROXY_SSL_PATCH
24442447
if (ctx->context == NGX_HTTP_LUA_CONTEXT_PROXY_SSL_VERIFY) {
24452448
return ctx->exit_code;
24462449
}
2450+
#endif
24472451

24482452
#if 1
24492453
if (!r->header_sent
@@ -3681,9 +3685,11 @@ ngx_http_lua_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
36813685
{
36823686
ngx_http_lua_ctx_t *ctx;
36833687
#if (NGX_HTTP_SSL)
3688+
#ifdef HAVE_PROXY_SSL_PATCH
36843689
ngx_http_upstream_t *u;
36853690
ngx_connection_t *c;
36863691
ngx_http_lua_ssl_ctx_t *cctx;
3692+
#endif
36873693
#endif
36883694

36893695
ctx = ngx_http_get_module_ctx(r, ngx_http_lua_module);
@@ -3692,6 +3698,7 @@ ngx_http_lua_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
36923698
}
36933699

36943700
#if (NGX_HTTP_SSL)
3701+
#ifdef HAVE_PROXY_SSL_PATCH
36953702
u = r->upstream;
36963703
if (u) {
36973704
c = u->peer.connection;
@@ -3714,6 +3721,7 @@ ngx_http_lua_finalize_request(ngx_http_request_t *r, ngx_int_t rc)
37143721
}
37153722
}
37163723
}
3724+
#endif
37173725
#endif
37183726

37193727
if (r->connection->fd != (ngx_socket_t) -1) {

‎src/ngx_http_lua_util.h

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,8 @@
3232

3333
#define NGX_HTTP_LUA_ESCAPE_HEADER_VALUE 8
3434

35+
#ifdef HAVE_PROXY_SSL_PATCH
36+
3537
#define NGX_HTTP_LUA_CONTEXT_YIELDABLE (NGX_HTTP_LUA_CONTEXT_REWRITE \
3638
| NGX_HTTP_LUA_CONTEXT_SERVER_REWRITE \
3739
| NGX_HTTP_LUA_CONTEXT_ACCESS \
@@ -42,11 +44,26 @@
4244
| NGX_HTTP_LUA_CONTEXT_SSL_CERT \
4345
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH)
4446

47+
#else
48+
49+
#define NGX_HTTP_LUA_CONTEXT_YIELDABLE (NGX_HTTP_LUA_CONTEXT_REWRITE \
50+
| NGX_HTTP_LUA_CONTEXT_SERVER_REWRITE \
51+
| NGX_HTTP_LUA_CONTEXT_ACCESS \
52+
| NGX_HTTP_LUA_CONTEXT_CONTENT \
53+
| NGX_HTTP_LUA_CONTEXT_TIMER \
54+
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO \
55+
| NGX_HTTP_LUA_CONTEXT_SSL_CERT \
56+
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH)
57+
58+
#endif /* HAVE_PROXY_SSL_PATCH */
59+
4560

4661
/* key in Lua vm registry for all the "ngx.ctx" tables */
4762
#define ngx_http_lua_ctx_tables_key "ngx_lua_ctx_tables"
4863

4964

65+
#ifdef HAVE_PROXY_SSL_PATCH
66+
5067
#define ngx_http_lua_context_name(c) \
5168
((c) == NGX_HTTP_LUA_CONTEXT_SET ? "set_by_lua*" \
5269
: (c) == NGX_HTTP_LUA_CONTEXT_REWRITE ? "rewrite_by_lua*" \
@@ -71,6 +88,32 @@
7188
"ssl_session_fetch_by_lua*" \
7289
: "(unknown)")
7390

91+
#else
92+
93+
#define ngx_http_lua_context_name(c) \
94+
((c) == NGX_HTTP_LUA_CONTEXT_SET ? "set_by_lua*" \
95+
: (c) == NGX_HTTP_LUA_CONTEXT_REWRITE ? "rewrite_by_lua*" \
96+
: (c) == NGX_HTTP_LUA_CONTEXT_SERVER_REWRITE ? "server_rewrite_by_lua*" \
97+
: (c) == NGX_HTTP_LUA_CONTEXT_ACCESS ? "access_by_lua*" \
98+
: (c) == NGX_HTTP_LUA_CONTEXT_CONTENT ? "content_by_lua*" \
99+
: (c) == NGX_HTTP_LUA_CONTEXT_LOG ? "log_by_lua*" \
100+
: (c) == NGX_HTTP_LUA_CONTEXT_HEADER_FILTER ? "header_filter_by_lua*" \
101+
: (c) == NGX_HTTP_LUA_CONTEXT_BODY_FILTER ? "body_filter_by_lua*" \
102+
: (c) == NGX_HTTP_LUA_CONTEXT_TIMER ? "ngx.timer" \
103+
: (c) == NGX_HTTP_LUA_CONTEXT_INIT_WORKER ? "init_worker_by_lua*" \
104+
: (c) == NGX_HTTP_LUA_CONTEXT_EXIT_WORKER ? "exit_worker_by_lua*" \
105+
: (c) == NGX_HTTP_LUA_CONTEXT_BALANCER ? "balancer_by_lua*" \
106+
: (c) == NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO ? \
107+
"ssl_client_hello_by_lua*" \
108+
: (c) == NGX_HTTP_LUA_CONTEXT_SSL_CERT ? "ssl_certificate_by_lua*" \
109+
: (c) == NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE ? \
110+
"ssl_session_store_by_lua*" \
111+
: (c) == NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH ? \
112+
"ssl_session_fetch_by_lua*" \
113+
: "(unknown)")
114+
115+
#endif /* HAVE_PROXY_SSL_PATCH */
116+
74117

75118
#define ngx_http_lua_check_context(L, ctx, flags) \
76119
if (!((ctx)->context & (flags))) { \

0 commit comments

Comments
 (0)