Skip to content

Commit d10bcc7

Browse files
agentzhagentzh
committed
feature: SSL/TLS cosocket API
* added new method sslhandshake() to the stream-typed cosocket objects. * added new configuration directives lua_ssl_trusted_certificate, lua_ssl_verify_depth, lua_ssl_crl, lua_ssl_protocols, and lua_ssl_ciphers. Thanks aviramc for the original patch in #290.
1 parent 8acc73f commit d10bcc7

File tree

10 files changed

+2801
-11
lines changed

10 files changed

+2801
-11
lines changed

‎src/ngx_http_lua_common.h‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -164,6 +164,15 @@ struct ngx_http_lua_main_conf_s {
164164

165165

166166
typedef struct {
167+
#if (NGX_HTTP_SSL)
168+
ngx_ssl_t *ssl; /* shared by SSL cosockets */
169+
ngx_uint_t ssl_protocols;
170+
ngx_str_t ssl_ciphers;
171+
ngx_uint_t ssl_verify_depth;
172+
ngx_str_t ssl_trusted_certificate;
173+
ngx_str_t ssl_crl;
174+
#endif
175+
167176
ngx_flag_t force_read_body; /* whether force request body to
168177
be read */
169178

‎src/ngx_http_lua_module.c‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,10 @@ static char *ngx_http_lua_merge_loc_conf(ngx_conf_t *cf, void *parent,
3737
void *child);
3838
static ngx_int_t ngx_http_lua_init(ngx_conf_t *cf);
3939
static char *ngx_http_lua_lowat_check(ngx_conf_t *cf, void *post, void *data);
40+
#if (NGX_HTTP_SSL)
41+
static ngx_int_t ngx_http_lua_set_ssl(ngx_conf_t *cf,
42+
ngx_http_lua_loc_conf_t *llcf);
43+
#endif
4044

4145

4246
static ngx_conf_post_t ngx_http_lua_lowat_post =
@@ -46,6 +50,20 @@ static ngx_conf_post_t ngx_http_lua_lowat_post =
4650
static volatile ngx_cycle_t *ngx_http_lua_prev_cycle = NULL;
4751

4852

53+
#if (NGX_HTTP_SSL) && defined(nginx_version) && nginx_version >= 1001013
54+
55+
static ngx_conf_bitmask_t ngx_http_lua_ssl_protocols[] = {
56+
{ ngx_string("SSLv2"), NGX_SSL_SSLv2 },
57+
{ ngx_string("SSLv3"), NGX_SSL_SSLv3 },
58+
{ ngx_string("TLSv1"), NGX_SSL_TLSv1 },
59+
{ ngx_string("TLSv1.1"), NGX_SSL_TLSv1_1 },
60+
{ ngx_string("TLSv1.2"), NGX_SSL_TLSv1_2 },
61+
{ ngx_null_string, 0 }
62+
};
63+
64+
#endif
65+
66+
4967
static ngx_command_t ngx_http_lua_cmds[] = {
5068

5169
{ ngx_string("lua_max_running_timers"),
@@ -366,6 +384,49 @@ static ngx_command_t ngx_http_lua_cmds[] = {
366384
offsetof(ngx_http_lua_loc_conf_t, use_default_type),
367385
NULL },
368386

387+
#if (NGX_HTTP_SSL)
388+
389+
# if defined(nginx_version) && nginx_version >= 1001013
390+
391+
{ ngx_string("lua_ssl_protocols"),
392+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_1MORE,
393+
ngx_conf_set_bitmask_slot,
394+
NGX_HTTP_LOC_CONF_OFFSET,
395+
offsetof(ngx_http_lua_loc_conf_t, ssl_protocols),
396+
&ngx_http_lua_ssl_protocols },
397+
398+
# endif
399+
400+
{ ngx_string("lua_ssl_ciphers"),
401+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
402+
ngx_conf_set_str_slot,
403+
NGX_HTTP_LOC_CONF_OFFSET,
404+
offsetof(ngx_http_lua_loc_conf_t, ssl_ciphers),
405+
NULL },
406+
407+
{ ngx_string("lua_ssl_verify_depth"),
408+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
409+
ngx_conf_set_num_slot,
410+
NGX_HTTP_LOC_CONF_OFFSET,
411+
offsetof(ngx_http_lua_loc_conf_t, ssl_verify_depth),
412+
NULL },
413+
414+
{ ngx_string("lua_ssl_trusted_certificate"),
415+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
416+
ngx_conf_set_str_slot,
417+
NGX_HTTP_LOC_CONF_OFFSET,
418+
offsetof(ngx_http_lua_loc_conf_t, ssl_trusted_certificate),
419+
NULL },
420+
421+
{ ngx_string("lua_ssl_crl"),
422+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
423+
ngx_conf_set_str_slot,
424+
NGX_HTTP_LOC_CONF_OFFSET,
425+
offsetof(ngx_http_lua_loc_conf_t, ssl_crl),
426+
NULL },
427+
428+
#endif /* NGX_HTTP_SSL */
429+
369430
ngx_null_command
370431
};
371432

@@ -650,6 +711,12 @@ ngx_http_lua_create_loc_conf(ngx_conf_t *cf)
650711
* conf->body_filter_src = {{ 0, NULL }, NULL, NULL, NULL};
651712
* conf->body_filter_src_key = NULL
652713
* conf->body_filter_handler = NULL;
714+
*
715+
* conf->ssl = 0;
716+
* conf->ssl_protocols = 0;
717+
* conf->ssl_ciphers = { 0, NULL };
718+
* conf->ssl_trusted_certificate = { 0, NULL };
719+
* conf->ssl_crl = { 0, NULL };
653720
*/
654721

655722
conf->force_read_body = NGX_CONF_UNSET;
@@ -669,6 +736,9 @@ ngx_http_lua_create_loc_conf(ngx_conf_t *cf)
669736
conf->transform_underscores_in_resp_headers = NGX_CONF_UNSET;
670737
conf->log_socket_errors = NGX_CONF_UNSET;
671738

739+
#if (NGX_HTTP_SSL)
740+
conf->ssl_verify_depth = NGX_CONF_UNSET_UINT;
741+
#endif
672742

673743
return conf;
674744
}
@@ -716,6 +786,32 @@ ngx_http_lua_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
716786
conf->body_filter_src_key = prev->body_filter_src_key;
717787
}
718788

789+
#if (NGX_HTTP_SSL)
790+
791+
# if defined(nginx_version) && nginx_version >= 1001013
792+
793+
ngx_conf_merge_bitmask_value(conf->ssl_protocols, prev->ssl_protocols,
794+
(NGX_CONF_BITMASK_SET|NGX_SSL_SSLv3
795+
|NGX_SSL_TLSv1|NGX_SSL_TLSv1_1
796+
|NGX_SSL_TLSv1_2));
797+
798+
# endif
799+
800+
ngx_conf_merge_str_value(conf->ssl_ciphers, prev->ssl_ciphers,
801+
"DEFAULT");
802+
803+
ngx_conf_merge_uint_value(conf->ssl_verify_depth,
804+
prev->ssl_verify_depth, 1);
805+
ngx_conf_merge_str_value(conf->ssl_trusted_certificate,
806+
prev->ssl_trusted_certificate, "");
807+
ngx_conf_merge_str_value(conf->ssl_crl, prev->ssl_crl, "");
808+
809+
if (ngx_http_lua_set_ssl(cf, conf) != NGX_OK) {
810+
return NGX_CONF_ERROR;
811+
}
812+
813+
#endif
814+
719815
ngx_conf_merge_value(conf->force_read_body, prev->force_read_body, 0);
720816
ngx_conf_merge_value(conf->enable_code_cache, prev->enable_code_cache, 1);
721817
ngx_conf_merge_value(conf->http10_buffering, prev->http10_buffering, 1);
@@ -751,4 +847,74 @@ ngx_http_lua_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
751847
return NGX_CONF_OK;
752848
}
753849

850+
851+
#if (NGX_HTTP_SSL)
852+
853+
static ngx_int_t
854+
ngx_http_lua_set_ssl(ngx_conf_t *cf, ngx_http_lua_loc_conf_t *llcf)
855+
{
856+
ngx_pool_cleanup_t *cln;
857+
858+
llcf->ssl = ngx_pcalloc(cf->pool, sizeof(ngx_ssl_t));
859+
if (llcf->ssl == NULL) {
860+
return NGX_ERROR;
861+
}
862+
863+
llcf->ssl->log = cf->log;
864+
865+
if (ngx_ssl_create(llcf->ssl, llcf->ssl_protocols, NULL) != NGX_OK) {
866+
return NGX_ERROR;
867+
}
868+
869+
cln = ngx_pool_cleanup_add(cf->pool, 0);
870+
if (cln == NULL) {
871+
return NGX_ERROR;
872+
}
873+
874+
cln->handler = ngx_ssl_cleanup_ctx;
875+
cln->data = llcf->ssl;
876+
877+
if (SSL_CTX_set_cipher_list(llcf->ssl->ctx,
878+
(const char *) llcf->ssl_ciphers.data)
879+
== 0)
880+
{
881+
ngx_ssl_error(NGX_LOG_EMERG, cf->log, 0,
882+
"SSL_CTX_set_cipher_list(\"%V\") failed",
883+
&llcf->ssl_ciphers);
884+
return NGX_ERROR;
885+
}
886+
887+
if (llcf->ssl_trusted_certificate.len) {
888+
889+
#if defined(nginx_version) && nginx_version >= 1003007
890+
891+
if (ngx_ssl_trusted_certificate(cf, llcf->ssl,
892+
&llcf->ssl_trusted_certificate,
893+
llcf->ssl_verify_depth)
894+
!= NGX_OK)
895+
{
896+
return NGX_ERROR;
897+
}
898+
899+
#else
900+
901+
ngx_log_error(NGX_LOG_CRIT, cf->log, 0, "at least nginx 1.3.7 is "
902+
"required for the \"lua_ssl_trusted_certificate\" "
903+
"directive");
904+
return NGX_ERROR;
905+
906+
#endif
907+
}
908+
909+
dd("ssl crl: %.*s", (int) llcf->ssl_crl.len, llcf->ssl_crl.data);
910+
911+
if (ngx_ssl_crl(cf, llcf->ssl, &llcf->ssl_crl) != NGX_OK) {
912+
return NGX_ERROR;
913+
}
914+
915+
return NGX_OK;
916+
}
917+
918+
#endif /* NGX_HTTP_SSL */
919+
754920
/* vi:set ft=c ts=4 sw=4 et fdm=marker: */

0 commit comments

Comments
 (0)