From c43795716ded5f422fba78bdb6b90f372a086d7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=80=97=E5=AD=90?= Date: Tue, 3 Nov 2026 05:02:28 +0800 Subject: [PATCH] bugfix: lua_ssl_verify_depth and lua_ssl_certificate* were not initialized without proxy SSL support. The srv conf initialized ssl_verify_depth, ssl_certificates and ssl_certificate_keys only when HAVE_LUA_PROXY_SSL was defined, that is, with OpenSSL 3.0.2 or later, while the lua_ssl_verify_depth, lua_ssl_certificate and lua_ssl_certificate_key directives are always available. With BoringSSL, LibreSSL or older OpenSSL versions the fields stayed zero, so lua_ssl_verify_depth was always rejected as a duplicate directive, the verify depth of cosockets defaulted to 0 instead of 1, and lua_ssl_certificate* were not inherited from the stream {} block. Initialize them whenever SSL is enabled, as ngx_http_lua_module does. Co-Authored-By: Claude Opus 5.5 --- src/ngx_stream_lua_module.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/ngx_stream_lua_module.c b/src/ngx_stream_lua_module.c index 772e8c55..841457da 100644 --- a/src/ngx_stream_lua_module.c +++ b/src/ngx_stream_lua_module.c @@ -921,10 +921,13 @@ ngx_stream_lua_create_srv_conf(ngx_conf_t *cf) conf->log_socket_errors = NGX_CONF_UNSET; -#ifdef HAVE_LUA_PROXY_SSL +#if (NGX_STREAM_SSL) conf->ssl_verify_depth = NGX_CONF_UNSET_UINT; conf->ssl_certificates = NGX_CONF_UNSET_PTR; conf->ssl_certificate_keys = NGX_CONF_UNSET_PTR; +#endif + +#ifdef HAVE_LUA_PROXY_SSL conf->ups.upstream_skip_openssl_default_verify = NGX_CONF_UNSET; #endif