1
- local ffi = require (" ffi" )
2
- local base = require (" resty.core.base" )
1
+ -- Copyright (C) by OpenResty Inc.
2
+
3
+
4
+ local base = require " resty.core.base"
5
+ local ffi = require " ffi"
6
+
3
7
4
8
local C = ffi .C
5
- local ffi_string = ffi .string
9
+ local ffi_str = ffi .string
6
10
local ffi_gc = ffi .gc
7
11
local FFI_ERROR = base .FFI_ERROR
8
12
local FFI_DONE = base .FFI_DONE
9
13
local FFI_OK = base .FFI_OK
10
14
local FFI_AGAIN = base .FFI_AGAIN
11
15
local FFI_NO_REQ_CTX = base .FFI_NO_REQ_CTX
12
16
local get_request = base .get_request
17
+ local new_tab = base .new_tab
18
+ local clear_tab = base .clear_tab
13
19
local error = error
14
20
local assert = assert
15
21
local type = type
16
22
local pcall = pcall
17
23
local select = select
18
24
local co_yield = coroutine ._yield
19
- local table_new = require (" table.new" )
20
- local table_clear = require (" table.clear" )
25
+
21
26
22
27
ffi .cdef [[
23
28
typedef struct ngx_http_lua_socket_tcp_upstream_s
@@ -26,11 +31,12 @@ typedef struct ngx_http_lua_socket_tcp_upstream_s
26
31
int ngx_http_lua_ffi_socket_tcp_tlshandshake (ngx_http_request_t * r ,
27
32
ngx_http_lua_socket_tcp_upstream_t * u , void * sess ,
28
33
int enable_session_reuse , ngx_str_t * server_name , int verify ,
29
- int ocsp_status_req , void * chain , void * pkey ,
30
- char ** errmsg );
34
+ int ocsp_status_req , void * chain , void * pkey , char ** errmsg );
35
+
31
36
int ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (ngx_http_request_t * r ,
32
- ngx_http_lua_socket_tcp_upstream_t * u , void ** sess ,
33
- char ** errmsg , int * openssl_error_code );
37
+ ngx_http_lua_socket_tcp_upstream_t * u , void ** sess , char ** errmsg ,
38
+ int * openssl_error_code );
39
+
34
40
void ngx_http_lua_ffi_tls_free_session (void * sess );
35
41
]]
36
42
@@ -42,22 +48,21 @@ local errmsg = base.get_errmsg_ptr()
42
48
local session_ptr = ffi .new (" void *[1]" )
43
49
local server_name_str = ffi .new (" ngx_str_t[1]" )
44
50
local openssl_error_code = ffi .new (" int[1]" )
45
- local cached_options = table_new (0 , 4 )
51
+ local cached_options = new_tab (0 , 4 )
46
52
47
53
48
54
local function tlshandshake (self , options )
49
55
if not options then
50
- table_clear (cached_options )
56
+ clear_tab (cached_options )
51
57
options = cached_options
52
58
53
59
elseif type (options ) ~= " table" then
54
- error (" bad options table type " )
60
+ error (" bad options arg: table expected " , 2 )
55
61
end
56
62
57
63
local r = get_request ()
58
-
59
64
if not r then
60
- error (" no request found" )
65
+ error (" no request found" , 2 )
61
66
end
62
67
63
68
local reused_session = options .reused_session
@@ -73,77 +78,73 @@ local function tlshandshake(self, options)
73
78
end
74
79
75
80
local client_cert = options .client_cert
76
- local client_priv_key = options .client_priv_key
81
+ local client_pkey = options .client_priv_key
77
82
if client_cert then
78
- if not client_priv_key then
79
- error (" client certificate supplied without "
80
- .. " corresponding private key" , 2 )
83
+ if not client_pkey then
84
+ error (" client certificate supplied without corresponding " ..
85
+ " private key" , 2 )
81
86
end
82
87
83
- if type (client_cert ) ~= " cdata"
84
- or type (client_priv_key ) ~= " cdata"
85
- then
86
- error (" wrong type of client certificate or private key supplied" , 2 )
88
+ if type (client_cert ) ~= " cdata" then
89
+ error (" bad client_cert option type" , 2 )
90
+ end
91
+
92
+ if type (client_pkey ) ~= " cdata" then
93
+ error (" bad client_priv_key option type" , 2 )
87
94
end
88
95
end
89
96
90
- local rc =
91
- C .ngx_http_lua_ffi_socket_tcp_tlshandshake (r , self [SOCKET_CTX_INDEX ],
92
- session_ptr [0 ],
93
- reused_session ~= false ,
94
- server_name_str ,
95
- options .verify and 1 or 0 ,
96
- options .ocsp_status_req
97
- and 1 or 0 ,
98
- client_cert ,
99
- client_priv_key ,
100
- errmsg )
97
+ local u = self [SOCKET_CTX_INDEX ]
98
+
99
+ local rc = C .ngx_http_lua_ffi_socket_tcp_tlshandshake (r , u ,
100
+ session_ptr [0 ],
101
+ reused_session ~= false ,
102
+ server_name_str ,
103
+ options .verify and 1 or 0 ,
104
+ options .ocsp_status_req and 1 or 0 ,
105
+ client_cert , client_pkey , errmsg )
101
106
102
107
if rc == FFI_NO_REQ_CTX then
103
108
error (" no request ctx found" , 2 )
104
109
end
105
110
106
- :: again::
111
+ while true do
112
+ if rc == FFI_ERROR then
113
+ if openssl_error_code [0 ] ~= 0 then
114
+ return nil , openssl_error_code [0 ] .. " : " .. ffi_str (errmsg [0 ])
115
+ end
107
116
108
- if rc == FFI_ERROR then
109
- if openssl_error_code [0 ] ~= 0 then
110
- return nil , openssl_error_code [0 ] .. " : " .. ffi_string (errmsg [0 ])
117
+ return nil , ffi_str (errmsg [0 ])
111
118
end
112
119
113
- return nil , ffi_string (errmsg [0 ])
114
- end
115
-
116
- if rc == FFI_DONE then
117
- return options .reused_session
118
- end
119
-
120
- if rc == FFI_OK then
121
- if options .reused_session == false then
122
- return true
120
+ if rc == FFI_DONE then
121
+ return reused_session
123
122
end
124
123
125
- rc = C . ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result ( r ,
126
- self [ SOCKET_CTX_INDEX ], session_ptr , errmsg , openssl_error_code )
127
-
128
- assert ( rc == FFI_OK )
124
+ if rc == FFI_OK then
125
+ if reused_session == false then
126
+ return true
127
+ end
129
128
130
- if session_ptr [0 ] == nil then
131
- return session_ptr [0 ]
132
- end
129
+ rc = C .ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (r , u ,
130
+ session_ptr , errmsg , openssl_error_code )
133
131
134
- return ffi_gc (session_ptr [0 ], C .ngx_http_lua_ffi_tls_free_session )
135
- end
132
+ assert (rc == FFI_OK )
136
133
137
- assert (rc == FFI_AGAIN )
134
+ if session_ptr [0 ] == nil then
135
+ return nil
136
+ end
138
137
139
- co_yield ()
138
+ return ffi_gc (session_ptr [0 ], C .ngx_http_lua_ffi_tls_free_session )
139
+ end
140
140
141
- rc = C .ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (r ,
142
- self [SOCKET_CTX_INDEX ], session_ptr , errmsg , openssl_error_code )
141
+ assert (rc == FFI_AGAIN )
143
142
144
- assert ( rc == FFI_OK or rc == FFI_ERROR )
143
+ co_yield ( )
145
144
146
- goto again
145
+ rc = C .ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (r , u ,
146
+ session_ptr , errmsg , openssl_error_code )
147
+ end
147
148
end
148
149
149
150
@@ -152,8 +153,8 @@ local function sslhandshake(self, reused_session, server_name, ssl_verify,
152
153
153
154
local n = select (" #" , ... )
154
155
if not self or n > 1 then
155
- error (" ngx.socket sslhandshake: expecting 1 ~ 5 "
156
- .. " arguments (including the object), but seen " .. n )
156
+ error (" ngx.socket sslhandshake: expecting 1 ~ 5 arguments " ..
157
+ " (including the object), but seen " .. ( self and 5 + n or 0 ) )
157
158
end
158
159
159
160
cached_options .reused_session = reused_session
@@ -162,7 +163,8 @@ local function sslhandshake(self, reused_session, server_name, ssl_verify,
162
163
cached_options .ocsp_status_req = send_status_req
163
164
164
165
local res , err = tlshandshake (self , cached_options )
165
- table_clear (cached_options )
166
+
167
+ clear_tab (cached_options )
166
168
167
169
return res , err
168
170
end
0 commit comments