feature: support ssl.create_ctx and tcp:setsslctx

src/ngx_http_lua_socket_tcp.c

@@ -183,6 +183,12 @@ enum {
     }
 
 
+#if (NGX_HTTP_SSL)
+
+#define ngx_http_lua_ngx_socket_tcp_mt_key  "__ngx_socket_tcp_mt"
+
+#endif
+
 static char ngx_http_lua_req_socket_metatable_key;
 static char ngx_http_lua_raw_req_socket_metatable_key;
 static char ngx_http_lua_tcp_socket_metatable_key;
@@ -316,6 +322,19 @@ ngx_http_lua_inject_socket_tcp_api(ngx_log_t *log, lua_State *L)
 
     lua_pushvalue(L, -1);
     lua_setfield(L, -2, "__index");
+
+#if (NGX_HTTP_SSL)
+
+#ifndef NGX_LUA_NO_FFI_API
+
+    /* expose tcp object metatable to global for FFI */
+    lua_pushvalue(L, -1);
+    lua_setglobal(L, ngx_http_lua_ngx_socket_tcp_mt_key);
+
+#endif /* NGX_LUA_NO_FFI_API */
+
+#endif /* NGX_HTTP_SSL */
+
     lua_rawset(L, LUA_REGISTRYINDEX);
     /* }}} */
 
@@ -587,6 +606,12 @@ ngx_http_lua_socket_tcp_connect(lua_State *L)
 
     u->conf = llcf;
 
+#if (NGX_HTTP_SSL)
+
+    u->ssl = llcf->ssl;
+
+#endif
+
     pc = &u->peer;
 
     pc->log = r->connection->log;
@@ -1200,6 +1225,35 @@ ngx_http_lua_socket_conn_error_retval_handler(ngx_http_request_t *r,
 
 #if (NGX_HTTP_SSL)
 
+
+#ifndef NGX_LUA_NO_FFI_API
+
+int
+ngx_http_lua_ffi_socket_tcp_setsslctx(ngx_http_request_t *r,
+    ngx_http_lua_socket_tcp_upstream_t *u, void *cdata_ctx, char **err)
+{
+    SSL_CTX   *ssl_ctx = cdata_ctx;
+
+    ngx_ssl_t *ssl;
+
+    ssl = ngx_pcalloc(r->pool, sizeof(ngx_ssl_t));
+    if (ssl == NULL) {
+        *err = "no memory";
+        return NGX_ERROR;
+    }
+
+    ssl->ctx = ssl_ctx;
+    ssl->log = u->ssl->log;
+    ssl->buffer_size = u->ssl->buffer_size;
+
+    u->ssl = ssl;
+
+    return NGX_OK;
+}
+
+#endif /* NGX_LUA_NO_FFI_API */
+
+
 static int
 ngx_http_lua_socket_tcp_sslhandshake(lua_State *L)
 {
@@ -1286,7 +1340,7 @@ ngx_http_lua_socket_tcp_sslhandshake(lua_State *L)
         return 1;
     }
 
-    if (ngx_ssl_create_connection(u->conf->ssl, c,
+    if (ngx_ssl_create_connection(u->ssl, c,
                                   NGX_SSL_BUFFER|NGX_SSL_CLIENT)
         != NGX_OK)
     {

src/ngx_http_lua_socket_tcp.h

@@ -92,6 +92,7 @@ struct ngx_http_lua_socket_tcp_upstream_s {
 
 #if (NGX_HTTP_SSL)
     ngx_str_t                        ssl_name;
+    ngx_ssl_t                        *ssl;
 #endif
 
     unsigned                         ft_type:16;

src/ngx_http_lua_ssl.c

@@ -34,4 +34,132 @@ ngx_http_lua_ssl_init(ngx_log_t *log)
 }
 
 
+#ifndef NGX_LUA_NO_FFI_API
+
+
+void *
+ngx_http_lua_ffi_ssl_ctx_init(ngx_uint_t protocols, char **err)
+{
+    ngx_ssl_t                ssl;
+
+    ssl.log = ngx_cycle->log;
+    if (ngx_ssl_create(&ssl, protocols, NULL) != NGX_OK) {
+        *err = "failed to create ssl ctx";
+        ngx_log_error(NGX_LOG_ERR, ssl.log, 0, *err);
+        return NULL;
+    }
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, ssl.log, 0,
+                   "lua ssl ctx init: %p:%d", ssl.ctx, ssl.ctx->references);
+
+    return ssl.ctx;
+}
+
+
+int
+ngx_http_lua_ffi_ssl_ctx_set_cert(void *cdata_ctx, void *cdata_cert, char **err)
+{
+#ifdef LIBRESSL_VERSION_NUMBER
+
+    *err = "LibreSSL not supported";
+    return NGX_ERROR;
+
+#else
+
+#   if OPENSSL_VERSION_NUMBER < 0x1000205fL
+
+    *err = "at least OpenSSL 1.0.2e required but found " OPENSSL_VERSION_TEXT;
+    return NGX_ERROR;
+
+#   else
+
+    X509              *x509 = NULL;
+    SSL_CTX           *ssl_ctx = cdata_ctx;
+    STACK_OF(X509)    *cert = cdata_cert;
+
+#ifdef OPENSSL_IS_BORINGSSL
+    size_t             i;
+#else
+    int                i;
+#endif
+
+    if (sk_X509_num(cert) < 1) {
+        *err = "sk_X509_num() failed";
+        ngx_ssl_error(NGX_LOG_ERR, ngx_cycle->log, 0, *err);
+        return NGX_ERROR;
+    }
+
+    x509 = sk_X509_value(cert, 0);
+    if (x509 == NULL) {
+        *err = "sk_X509_value() failed";
+        ngx_ssl_error(NGX_LOG_ERR, ngx_cycle->log, 0, *err);
+        return NGX_ERROR;
+    }
+
+    if (SSL_CTX_use_certificate(ssl_ctx, x509) == 0) {
+        *err = "SSL_CTX_use_certificate() failed";
+        ngx_ssl_error(NGX_LOG_ERR, ngx_cycle->log, 0, *err);
+        return NGX_ERROR;
+    }
+
+    /* read rest of the chain */
+
+    for (i = 1; i < sk_X509_num(cert); i++) {
+
+        x509 = sk_X509_value(cert, i);
+        if (x509 == NULL) {
+            *err = "sk_X509_value() failed";
+            ngx_ssl_error(NGX_LOG_ERR, ngx_cycle->log, 0, *err);
+            return NGX_ERROR;
+        }
+
+        if (SSL_CTX_add1_chain_cert(ssl_ctx, x509) == 0) {
+            *err = "SSL_add1_chain_cert() failed";
+            ngx_ssl_error(NGX_LOG_ERR, ngx_cycle->log, 0, *err);
+            return NGX_ERROR;
+        }
+    }
+
+    return NGX_OK;
+
+#   endif  /* OPENSSL_VERSION_NUMBER < 0x1000205fL */
+#endif
+}
+
+
+int
+ngx_http_lua_ffi_ssl_ctx_set_priv_key(void *cdata_ctx, void *cdata_key,
+    char **err)
+{
+    SSL_CTX     *ssl_ctx = cdata_ctx;
+    EVP_PKEY    *key = cdata_key;
+
+    if (SSL_CTX_use_PrivateKey(ssl_ctx, key) == 0) {
+        *err = "SSL_CTX_use_PrivateKey() failed";
+        ngx_ssl_error(NGX_LOG_ERR, ngx_cycle->log, 0, *err);
+        return NGX_ERROR;
+    }
+
+    return NGX_OK;
+}
+
+
+void
+ngx_http_lua_ffi_ssl_ctx_free(void *cdata)
+{
+    SSL_CTX *ssl_ctx = cdata;
+
+    ngx_log_debug2(NGX_LOG_DEBUG_HTTP, ngx_cycle->log,
+                   0,
+                   "lua ssl ctx free: %p:%d",
+                   ssl_ctx,
+                   ssl_ctx->references);
+
+    SSL_CTX_free(ssl_ctx);
+}
+
+
+#endif /* NGX_LUA_NO_FFI_API */
+
+
 #endif /* NGX_HTTP_SSL */

t/151-ssl-ctx.t

@@ -0,0 +1,73 @@
+# vim:set ft= ts=4 sw=4 et fdm=marker:
+
+use Test::Nginx::Socket::Lua;
+use Digest::MD5 qw(md5_hex);
+
+repeat_each(3);
+
+plan tests => repeat_each() * (blocks());
+
+$ENV{TEST_NGINX_HTML_DIR} ||= html_dir();
+
+log_level 'debug';
+
+no_long_string();
+
+add_block_preprocessor(sub {
+    my $block = shift;
+
+    if (!defined $block->user_files) {
+        $block->set_value("user_files", <<'_EOC_');
+>>> defines.lua
+local ffi = require "ffi"
+
+ffi.cdef[[
+    void *ngx_http_lua_ffi_ssl_ctx_init(unsigned int protocols, char **err);
+
+    void ngx_http_lua_ffi_ssl_ctx_free(void *cdata);
+
+    int ngx_http_lua_ffi_ssl_ctx_set_priv_key(void *cdata_ctx,
+        void *cdata_key, char **err);
+
+    int ngx_http_lua_ffi_ssl_ctx_set_cert(void *cdata_ctx,
+        void *cdata_cert, char **err);
+]]
+_EOC_
+    }
+
+    my $http_config = $block->http_config || '';
+    $http_config .= <<'_EOC_';
+lua_package_path "$prefix/html/?.lua;;";
+_EOC_
+    $block->set_value("http_config", $http_config);
+});
+
+run_tests();
+
+__DATA__
+
+=== TEST 1: ssl ctx init and free
+--- log_level: debug
+--- config
+    location /t {
+        content_by_lua_block {
+            require "defines"
+            local ffi = require "ffi"
+            local errmsg = ffi.new("char *[1]")
+            local ctx = ffi.C.ngx_http_lua_ffi_ssl_ctx_init(0, errmsg)
+            if ctx == nil then
+                ngx.say(ffi.string(errmsg[0]))
+                return
+            end
+
+            ffi.C.ngx_http_lua_ffi_ssl_ctx_free(ctx)
+        }
+    }
+--- request
+GET /t
+--- ignore_response
+--- grep_error_log eval: qr/lua ssl ctx (?:init|free): [0-9A-F]+:\d+/
+--- grep_error_log_out eval
+qr/^lua ssl ctx init: ([0-9A-F]+):1
+lua ssl ctx free: ([0-9A-F]+):1
+$/