feature: added ssl_certificiate_by_lua* directives to allow controlling downstream SSL handshakes with Lua #637

agentzh · 2016-01-03T21:43:11Z

This pull request relies on the following nginx core patch:

https://github.com/openresty/ngx_openresty/blob/master/patches/nginx-1.9.7-ssl_cert_cb_yield.patch

(already proposed to the nginx-devel mailing list: http://mailman.nginx.org/pipermail/nginx-devel/2016-January/007748.html )

This pull request couples with the ssl-cert-by-lua-2 branch of lua-resty-core. See the following pull request of lua-resty-core for the Lua API:

openresty/lua-resty-core#12

Related new documentation:

https://github.com/openresty/lua-nginx-module/tree/ssl-cert-by-lua-2#ssl_certificate_by_lua_block

See #331 for more details on the requirements and development history.

…y_lua_file directives. also added the Lua module ngx.ssl under the lua/ directory.

…d cert_pem_to_der().

…RORS/lua-nginx-module into ssl-cert-by-lua Conflicts: lua/ngx/ssl.lua src/ngx_http_lua_sslcertby.c t/130-ssl-cert-by.t

…e ngx.ssl module.

…module.

…ua module.

…tus_req", for sending the status request in the TLS status extension.

…y-core library.

…p_run_posted_requests. we now avoid running the openssl handshake dispatcher directly in our fake connection's pool cleanup handler by means of posting an event.

…tls1_version_str().

…context. also ensure Lua runtime errors are properly propagated.

…e_by_lua*.

…tion fails. thanks Piotr Sikora for the report.

…ection is closed prematurely.

…lient: xxx, server: xxx" context info. thanks Piotr Sikora for the suggestion.

…ted tests since they are now going to lua-resty-core.

…g the nginx core. yay!

… context.

…l_certificate_by_lua*.

…ks yejingx for the patch in #537.

agentzh · 2016-01-03T23:34:05Z

@lziest @lordnynex @bungle @doujiang24 @andrea-spoldi @moseleymark @marklkelly @yejingx and others (sorry if I didn't mention your names explicitly). Please review this PR for me :) Thanks!

…ke().

lziest · 2016-01-04T06:13:45Z

patches/nginx-ssl-cert.patch

+     ngx_event_handler_pt        saved_read_handler;
+     ngx_event_handler_pt        saved_write_handler;
+
+    void                       *lua_ctx;  /* used by 3rd-party modules */


so this can be removed now. right?

@lziest Oh, this patch is already obsolete. I've just removed the whole patch file :) Thanks for the catch.

lziest · 2016-01-04T06:14:37Z

lgtm

bungle · 2016-01-04T11:08:16Z

Hi,

On ssl.t there are lines like this:

received: Server: nginx

Should it really be:

received: Server: openresty

bungle · 2016-01-04T11:14:26Z

If I change that received: Server thing, I still get a few errors:
https://gist.github.com/bungle/c969454d66bafbe9c046

Is it because of my configs or something? (ocsp.t runs with all test passed)

bungle · 2016-01-04T11:17:54Z

I also added some locals to ocsp.lua and ssl.lua here:
openresty/lua-resty-core#13

agentzh · 2016-01-04T19:34:26Z

@bungle The Server header thing is that I usually use NGINX instead of OpenResty to run those tests. In particular, I use the following script to build an NGINX to run these tests:

https://github.com/openresty/lua-nginx-module/blob/master/util/build2.sh

To run the tests on Mac OS X, we have to add 127.0.0.2 to the loopback device, via the following command:

sudo ifconfig lo0 alias 127.0.0.2 up

agentzh · 2016-01-04T19:44:31Z

@bungle The failed raw_server_addr tests on Mac OS X reveal a bug in my implementation. I'll commit a fix soon :) Thanks!

… the ABI, which is not portable. thanks Aapo Talvensaari for the report.

agentzh · 2016-01-05T04:53:09Z

Okay, this branch has just been merged into master. I'm closing this. Further issues should go to separate tickets :)

agentzh added 30 commits September 24, 2014 15:40

feature: implemented the ssl_certificate_by_lua and ssl_certificate_b…

e7705e5

…y_lua_file directives. also added the Lua module ngx.ssl under the lua/ directory.

tests: added passing tests for set DER certificate chain.

5b81bc6

feature: implemented the ssl_certificate_by_lua and ssl_certificate_b…

dd5644e

…y_lua_file directives. also added the Lua module ngx.ssl under the lua/ directory.

tests: added passing tests for set DER certificate chain.

e5fbd97

feature: ngx.ssl: renamed set_der_pkey to set_der_priv_key. also adde…

11c1131

…d cert_pem_to_der().

Merge branch 'ssl-cert-by-lua' of ssh://stash.cloudflare.com:7999/MIR…

c04b57e

…RORS/lua-nginx-module into ssl-cert-by-lua Conflicts: lua/ngx/ssl.lua src/ngx_http_lua_sslcertby.c t/130-ssl-cert-by.t

refactor: renamed the "ctx" field in ngx_ssl_connection_t to "lua_ctx".

942d460

feature: added the get_ocsp_responder_from_der_chain() function to th…

e2db181

…e ngx.ssl module.

feature: added the create_ocsp_request() function to the ngx.ssl Lua …

418a977

…module.

feature: added new function validate_ocsp_response() to the ngx.ssl L…

3a170b4

…ua module.

style: minor fixes.

da70dfe

feature: tcpsock:sslhandshake(): added an optional 5th argument, "sta…

7c09341

…tus_req", for sending the status request in the TLS status extension.

ngx.ssl: make use of the new FFI_BUSY constant in the latest lua-rest…

08300ab

…y-core library.

feature: ngx.ssl: added new Lua function set_ocsp_status_resp().

d66e6f1

bugfix: ssl_certificate_by_lua: memory issues might happen in ngx_htt…

4eec342

…p_run_posted_requests. we now avoid running the openssl handshake dispatcher directly in our fake connection's pool cleanup handler by means of posting an event.

feature: ngx.ssl: added new Lua functions get_tls1_version() and get_…

8c3c48b

…tls1_version_str().

ssl_certificate_by_lua: removed unused code.

f278484

ssl_certificate_by_lua*: enabled the ngx.exit() API function in this …

01ba35b

…context. also ensure Lua runtime errors are properly propagated.

Merge branch 'master' into ssl-cert-by-lua

26a31d4

bugfix: ngx.get_phase() did not work in the context of ssl_certificat…

1a0c632

…e_by_lua*.

Merge branch 'master' into ssl-cert-by-lua

73edb09

ssl: we did not clear OpenSSL's error stack when OCSP response valida…

a05bca3

…tion fails. thanks Piotr Sikora for the report.

removed --- ONLY from 014-bugs.t.

d29e1af

bugfix: we did not abort our set cert cb as soon as the main ssl conn…

da1803f

…ection is closed prematurely.

merge master into ssl-cert-by-lua.

99663aa

bugfix: fixed a merge issue.

c3b90b3

feature: ssl_certificate_by_lua*: now error messages contain the ", c…

c1ef760

…lient: xxx, server: xxx" context info. thanks Piotr Sikora for the suggestion.

Merge branch 'master' into ssl-cert-by-lua

c3c07c1

Merge branch 'master' into ssl-cert-by-lua

146763c

Merge branch 'master' into ssl-cert-by-lua

903fd2b

agentzh added 12 commits January 2, 2016 09:56

resolved issues due to the most recent merge.

29523de

refactor: removed the Lua modules ngx.ssl and ngx.ocsp and their rela…

ed9663d

…ted tests since they are now going to lua-resty-core.

refactor: now we no longer rely on the lua_ctx field added by patchin…

16cb774

…g the nginx core. yay!

minor coding style tweaks.

0659a97

feature: enabled the ngx.semaphore API in the ssl_certificate_by_lua*…

fd56abd

… context.

Merge branch 'master' into ssl-cert-by-lua-2

d391688

Merge branch 'master' into ssl-cert-by-lua-2

e238794

feature: enabled the datagram-typed cosocket API in the context of ss…

4d02c3f

…l_certificate_by_lua*.

documented the ssl_certificate_by_lua* directives.

34596e1

resolved conflicts while merging "master" into "ssl-cert-by-lua-2".

050221a

added pure C API function, ngx_http_lua_ffi_priv_key_pem_to_der. than…

d014f9a

…ks yejingx for the patch in #537.

doc: updated TODO to reflect recent changes.

acd0109

agentzh added 2 commits January 3, 2016 15:39

doc: fixed links for ssl_certificate_by_lua*.

3ab6105

doc: mentioned ngx.ssl and ngx.ocsp in the Lua API section.

f8200c4

agentzh mentioned this pull request Jan 4, 2016

feature: added new Lua modules ngx.ssl and ngx.ocsp for ssl_certificate_by_lua* openresty/lua-resty-core#12

Closed

doc: documented the optional "send_status_req" argument of sslhandsha…

76a4fa9

…ke().

lziest reviewed Jan 4, 2016
View reviewed changes

removed patches/nginx-ssl-cert.patch which is now obsolete.

ec10995

agentzh mentioned this pull request Jan 4, 2016

About lua_ssl question? #638

Closed

bugfix: ssl.raw_server_addr: avoided using constants like AF_INET6 in…

d03fd00

… the ABI, which is not portable. thanks Aapo Talvensaari for the report.

agentzh closed this Jan 5, 2016

agentzh deleted the ssl-cert-by-lua-2 branch July 20, 2016 00:16

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feature: added ssl_certificiate_by_lua* directives to allow controlling downstream SSL handshakes with Lua #637

feature: added ssl_certificiate_by_lua* directives to allow controlling downstream SSL handshakes with Lua #637

agentzh commented Jan 3, 2016

agentzh commented Jan 3, 2016

lziest Jan 4, 2016

agentzh Jan 4, 2016

lziest commented Jan 4, 2016

bungle commented Jan 4, 2016

bungle commented Jan 4, 2016

bungle commented Jan 4, 2016

agentzh commented Jan 4, 2016

agentzh commented Jan 4, 2016

agentzh commented Jan 5, 2016

feature: added ssl_certificiate_by_lua* directives to allow controlling downstream SSL handshakes with Lua #637

feature: added ssl_certificiate_by_lua* directives to allow controlling downstream SSL handshakes with Lua #637

Conversation

agentzh commented Jan 3, 2016

agentzh commented Jan 3, 2016

lziest Jan 4, 2016

Choose a reason for hiding this comment

agentzh Jan 4, 2016

Choose a reason for hiding this comment

lziest commented Jan 4, 2016

bungle commented Jan 4, 2016

bungle commented Jan 4, 2016

bungle commented Jan 4, 2016

agentzh commented Jan 4, 2016

agentzh commented Jan 4, 2016

agentzh commented Jan 5, 2016