feature: proxy_ssl_verify_by_lua directives #2436

willmafh · 2025-07-21T14:27:15Z

proxy_ssl_verify_by_lua directives

proxy_ssl_verify_by_lua directives are working after receiving server certificates, allowing us to control upstream ssl handshake dynamically with Lua
a series of related PRs
some of the docs hasn't finished yet, since the PR has not been merged, and some release infos can't be added, please review the codes first and docs may be updated later

working after receiving server certificates, allowing us to control upstream ssl handshake dynamically with Lua

to control whether to skip openssl's default verify function

…tion

…ify server certificate

HanadaLee · 2025-07-23T03:25:04Z

Should this pr be prepared for grpc and uwsgi module as well? They also support upstream SSL related configurations.

grpc_ssl_verify_by_lua
uwsgi_ssl_verify_by_lua

willmafh · 2025-07-29T04:39:42Z

Should this pr be prepared for grpc and uwsgi module as well? They also support upstream SSL related configurations.

grpc_ssl_verify_by_lua uwsgi_ssl_verify_by_lua

Let's first focus on proxy_ssl_verify_by_lua, since grpc/uwsgi are not that commonly used

willmafh · 2025-07-29T06:32:39Z

@agentzh @zhuizhuhaomeng ping for review...sorry to bother, but please take some time to review the PR, thanks!

src/ngx_http_lua_proxy_ssl_verifyby.c

src/ngx_http_lua_ctx.c

phases to upstream phases & its related test case

proxy ssl verify instead of fake request and connection.

zhuizhuhaomeng · 2025-09-14T07:02:09Z

README.markdown

+
+**phase:** *right-after-server-certificate-message-was-processed*
+
+Equivalent to [proxy_ssl_verify_by_lua_block](#proxy_ssl_verify_by_lua_block), except that the file specified by `<path-to-lua-script-file>` contains the Lua code, or, as from the `v0.5.0rc32` release, the [LuaJIT bytecode](#luajit-bytecode-support) to be executed.


why is v0.5.0rc32?

Copied from other places in this README.markdown, please search it!

zhuizhuhaomeng · 2025-09-14T07:30:00Z

src/ngx_http_lua_proxy_ssl_verifyby.c

+    cctx->original_request_count = r->main->count;
+    cctx->done = 0;
+    cctx->entered_proxy_ssl_verify_handler = 1;
+    cctx->pool = ngx_create_pool(128, c->log);


should we use c->pool?

Nope! c is upstream connection and we will destroy the pool when calling ngx_http_lua_proxy_ssl_verify_done for proxy ssl verify to reenter, but the connection to upstream need to maintain, so we create a new pool specially for proxy ssl.

zhuizhuhaomeng · 2025-09-14T07:32:40Z

src/ngx_http_lua_proxy_ssl_verifyby.c

+
+    c->log->action = "loading proxy ssl verify by lua";
+
+    if (llcf->proxy_ssl_verify_handler == NULL) {


Is this needed? Do you have test case to cover this code path?

Original code structure was copied from ngx_http_lua_ssl_certby.c, but it seems unnecessary, so I will delete it.

zhuizhuhaomeng · 2025-09-14T07:51:38Z

src/ngx_http_lua_proxy_ssl_verifyby.c

+
+
+int
+ngx_http_lua_ffi_ssl_get_verify_result(ngx_http_request_t *r, char **err)


Suggested change

ngx_http_lua_ffi_ssl_get_verify_result(ngx_http_request_t *r, char **err)

ngx_http_lua_ffi_get_upstream_ssl_verify_result(ngx_http_request_t *r, char **err)

These functions will be used in lua file proxysslverify.lua like this proxy_ssl_vfy.get_verify_result(23), it seems redundant to add upstream in the function name, or change it to ngx_http_lua_ffi_proxy_ssl_get_verify_result seems more reasonable?

zhuizhuhaomeng · 2025-09-14T07:56:41Z

src/ngx_http_lua_proxy_ssl_verifyby.c

+
+
+void
+ngx_http_lua_ffi_ssl_free_verify_cert(void *cdata)


Suggested change

ngx_http_lua_ffi_ssl_free_verify_cert(void *cdata)

ngx_http_lua_ffi_free_upstream_ssl_free_verify_cert(void *cdata)

same as above

zhuizhuhaomeng · 2025-09-14T07:57:10Z

src/ngx_http_lua_proxy_ssl_verifyby.c

+
+
+void *
+ngx_http_lua_ffi_ssl_get_verify_cert(ngx_http_request_t *r, char **err)


Suggested change

ngx_http_lua_ffi_ssl_get_verify_cert(ngx_http_request_t *r, char **err)

ngx_http_lua_ffi_get_upstream_ssl_verify_cert(ngx_http_request_t *r, char **err)

same as above

zhuizhuhaomeng · 2025-09-14T11:28:56Z

t/169-proxy-ssl-verify.t

+--- request
+GET /t
+--- response_body
+lua_upstream_skip_openssl_default_verify default off


should be on

The directive is lua_upstream_skip_openssl_default_verify, the default behavior is NOT to bypass openssl's default verify process, otherwise security problems maybe introduced, notice the semantic!

zhuizhuhaomeng · 2025-09-14T11:30:20Z

t/169-proxy-ssl-verify.t

+    plan tests => repeat_each() * (blocks() * 6 + 6);
+} else {
+    plan tests => repeat_each() * (blocks() * 5 + 10);
+}


We should add a test to test the client abort during the upstream ssl verify.

zhuizhuhaomeng · 2025-09-14T11:32:29Z

src/ngx_http_lua_module.c

+        conf->proxy_ssl_verify_chunkname = prev->proxy_ssl_verify_chunkname;
+    }
+
+    if (conf->proxy_ssl_verify_src.len) {


We should add a macro in th patch to test if the patch has been applied.

willmafh added 9 commits July 20, 2025 12:49

feature: proxy_ssl_verify_by_lua* directives

89923f2

working after receiving server certificates, allowing us to control upstream ssl handshake dynamically with Lua

proxy_ssl_verify_by_lua ffi functions build fix

58dda9a

feature: lua_upstream_skip_openssl_default_verify directive

0292dcd

to control whether to skip openssl's default verify function

Merge branch 'master' into proxy_ssl_verify_by_lua

56db2d1

optimize: better way to get server certificate of upstream SSL connec…

fe7bf4c

…tion

adjust where to process upstream skip openssl default verify

e655d53

chore: code style

eef8207

tests: update t/169-proxy-ssl-verify.t for client to successfully ver…

c774bd0

…ify server certificate

chore: test case code style

3923d54

zhuizhuhaomeng requested changes Aug 6, 2025

View reviewed changes

src/ngx_http_lua_proxy_ssl_verifyby.c Outdated Show resolved Hide resolved

willmafh commented Aug 7, 2025

View reviewed changes

src/ngx_http_lua_ctx.c Outdated Show resolved Hide resolved

willmafh and others added 5 commits August 14, 2025 12:52

better way to get proxy ssl context

744bebf

changes so that we can use ngx.ctx to pass data from downstream

e23517e

phases to upstream phases & its related test case

delete unnecessary proxy ssl verify context macro

1a5c4f5

refactor: using real request and connection to implement

1de837f

proxy ssl verify instead of fake request and connection.

fixed build

a7d8ed1

zhuizhuhaomeng requested changes Sep 14, 2025

View reviewed changes

willmafh added 2 commits September 14, 2025 22:12

chore: code cleanup

bfdc5a3

macro to conditional build proxy ssl verify

c4888f8

willmafh force-pushed the proxy_ssl_verify_by_lua branch from 143af2b to c4888f8 Compare September 15, 2025 03:09


		phase: right-after-server-certificate-message-was-processed

		Equivalent to [proxy_ssl_verify_by_lua_block](#proxy_ssl_verify_by_lua_block), except that the file specified by `<path-to-lua-script-file>` contains the Lua code, or, as from the `v0.5.0rc32` release, the [LuaJIT bytecode](#luajit-bytecode-support) to be executed.


		c->log->action = "loading proxy ssl verify by lua";

		if (llcf->proxy_ssl_verify_handler == NULL) {



		int
		ngx_http_lua_ffi_ssl_get_verify_result(ngx_http_request_t r, char *err)

	ngx_http_lua_ffi_ssl_get_verify_result(ngx_http_request_t r, char *err)
	ngx_http_lua_ffi_get_upstream_ssl_verify_result(ngx_http_request_t r, char *err)

	ngx_http_lua_ffi_ssl_free_verify_cert(void *cdata)
	ngx_http_lua_ffi_free_upstream_ssl_free_verify_cert(void *cdata)



		void *
		ngx_http_lua_ffi_ssl_get_verify_cert(ngx_http_request_t r, char *err)

feature: proxy_ssl_verify_by_lua directives #2436

Are you sure you want to change the base?

feature: proxy_ssl_verify_by_lua directives #2436

Uh oh!

Conversation

willmafh commented Jul 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

proxy_ssl_verify_by_lua directives

Uh oh!

HanadaLee commented Jul 23, 2025

Uh oh!

willmafh commented Jul 29, 2025

Uh oh!

willmafh commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

willmafh commented Jul 21, 2025 •

edited

Loading

willmafh commented Jul 29, 2025 •

edited

Loading