Repository navigation
Conversation
…lized without proxy SSL support.
The srv conf initialized ssl_verify_depth, ssl_certificates and
ssl_certificate_keys only when HAVE_LUA_PROXY_SSL was defined, that is,
with OpenSSL 3.0.2 or later, while the lua_ssl_verify_depth,
lua_ssl_certificate and lua_ssl_certificate_key directives are always
available. With BoringSSL, LibreSSL or older OpenSSL versions the fields
stayed zero, so lua_ssl_verify_depth was always rejected as a duplicate
directive, the verify depth of cosockets defaulted to 0 instead of 1,
and lua_ssl_certificate* were not inherited from the stream {} block.
Initialize them whenever SSL is enabled, as ngx_http_lua_module does.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
I hereby granted the copyright of the changes in this pull request
to the authors of this stream-lua-nginx-module project.
ngx_stream_lua_create_srv_conf()initializedssl_verify_depth,ssl_certificatesandssl_certificate_keysonly inside#ifdef HAVE_LUA_PROXY_SSL. That macro is defined only for OpenSSL 3.0.2 or later. Thelua_ssl_verify_depth,lua_ssl_certificateandlua_ssl_certificate_keydirectives are registered in every build.With BoringSSL, LibreSSL or OpenSSL older than 3.0.2, the fields were left at 0 from
ngx_pcalloc(), so:lua_ssl_verify_depthwas always rejected:"lua_ssl_verify_depth" directive is duplicate;lua_ssl_certificateandlua_ssl_certificate_keyset in thestream {}block were not inherited by servers, becausengx_conf_merge_ptr_value()only inherits fromNGX_CONF_UNSET_PTR.This change initializes them whenever
NGX_STREAM_SSLis set, asngx_http_lua_create_loc_conf()does withNGX_HTTP_SSL.ups.upstream_skip_openssl_default_verifystays underHAVE_LUA_PROXY_SSL, because its directive only exists there.Testing
On Ubuntu 22.04 (aarch64), nginx 1.31.8 built with
util/build.sh:6ca49385, the commit behind the boringssl-20230902 build used by lua-nginx-module's CI, and current main): before this change,t/129-ssl-socket.tandt/139-ssl-cert-by.tbailed out because nginx could not start, with the duplicate-directive error above. With this change both files run to completion. Some BoringSSL-specific failures remain in them. Those tests were not reached before, and the failures are unrelated to this change; for example, they expect OpenSSL's "cert cb error" text.t/129,t/139,t/140,t/162–t/167,t/170andt/171all pass. Nothing changes there, becauseHAVE_LUA_PROXY_SSLis defined.This repository's CI only builds with OpenSSL 3, so the bug does not show up there.
CI on master currently fails to build
ngx_stream_lua_shdict.c(since 68949e1); this branch is based on 9bc2e1f, the last green commit.Related: openresty/openresty#1159 (I came across this while looking into AWS-LC support).
🤖 Generated with Claude Code