Skip to content

Commit fef2581

Browse files
catbro666zhuizhuhaomeng
catbro666
authored and
zhuizhuhaomeng
committed
feature: implemented the ssl_client_hello_by_lua_block and ssl_client_hello_by_lua_file directives for controlling the NGINX downstream SSL handshake dynamically with Lua.
1 parent 776f829 commit fef2581

12 files changed

+3837
-203
lines changed

‎README.markdown‎

Lines changed: 222 additions & 92 deletions
Large diffs are not rendered by default.

‎config‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -286,6 +286,7 @@ HTTP_LUA_SRCS=" \
286286
$ngx_addon_dir/src/ngx_http_lua_timer.c \
287287
$ngx_addon_dir/src/ngx_http_lua_config.c \
288288
$ngx_addon_dir/src/ngx_http_lua_worker.c \
289+
$ngx_addon_dir/src/ngx_http_lua_ssl_client_helloby.c \
289290
$ngx_addon_dir/src/ngx_http_lua_ssl_certby.c \
290291
$ngx_addon_dir/src/ngx_http_lua_ssl_ocsp.c \
291292
$ngx_addon_dir/src/ngx_http_lua_lex.c \
@@ -347,6 +348,7 @@ HTTP_LUA_DEPS=" \
347348
$ngx_addon_dir/src/ngx_http_lua_uthread.h \
348349
$ngx_addon_dir/src/ngx_http_lua_timer.h \
349350
$ngx_addon_dir/src/ngx_http_lua_config.h \
351+
$ngx_addon_dir/src/ngx_http_lua_ssl_client_helloby.h \
350352
$ngx_addon_dir/src/ngx_http_lua_ssl_certby.h \
351353
$ngx_addon_dir/src/ngx_http_lua_lex.h \
352354
$ngx_addon_dir/src/ngx_http_lua_balancer.h \

‎doc/HttpLuaModule.wiki‎

Lines changed: 213 additions & 92 deletions
Large diffs are not rendered by default.

‎src/ngx_http_lua_common.h‎

Lines changed: 20 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -125,20 +125,21 @@ typedef struct {
125125

126126

127127
/* must be within 16 bit */
128-
#define NGX_HTTP_LUA_CONTEXT_SET 0x0001
129-
#define NGX_HTTP_LUA_CONTEXT_REWRITE 0x0002
130-
#define NGX_HTTP_LUA_CONTEXT_ACCESS 0x0004
131-
#define NGX_HTTP_LUA_CONTEXT_CONTENT 0x0008
132-
#define NGX_HTTP_LUA_CONTEXT_LOG 0x0010
133-
#define NGX_HTTP_LUA_CONTEXT_HEADER_FILTER 0x0020
134-
#define NGX_HTTP_LUA_CONTEXT_BODY_FILTER 0x0040
135-
#define NGX_HTTP_LUA_CONTEXT_TIMER 0x0080
136-
#define NGX_HTTP_LUA_CONTEXT_INIT_WORKER 0x0100
137-
#define NGX_HTTP_LUA_CONTEXT_BALANCER 0x0200
138-
#define NGX_HTTP_LUA_CONTEXT_SSL_CERT 0x0400
139-
#define NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE 0x0800
140-
#define NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH 0x1000
141-
#define NGX_HTTP_LUA_CONTEXT_EXIT_WORKER 0x2000
128+
#define NGX_HTTP_LUA_CONTEXT_SET 0x0001
129+
#define NGX_HTTP_LUA_CONTEXT_REWRITE 0x0002
130+
#define NGX_HTTP_LUA_CONTEXT_ACCESS 0x0004
131+
#define NGX_HTTP_LUA_CONTEXT_CONTENT 0x0008
132+
#define NGX_HTTP_LUA_CONTEXT_LOG 0x0010
133+
#define NGX_HTTP_LUA_CONTEXT_HEADER_FILTER 0x0020
134+
#define NGX_HTTP_LUA_CONTEXT_BODY_FILTER 0x0040
135+
#define NGX_HTTP_LUA_CONTEXT_TIMER 0x0080
136+
#define NGX_HTTP_LUA_CONTEXT_INIT_WORKER 0x0100
137+
#define NGX_HTTP_LUA_CONTEXT_BALANCER 0x0200
138+
#define NGX_HTTP_LUA_CONTEXT_SSL_CERT 0x0400
139+
#define NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE 0x0800
140+
#define NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH 0x1000
141+
#define NGX_HTTP_LUA_CONTEXT_EXIT_WORKER 0x2000
142+
#define NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO 0x4000
142143

143144

144145
#define NGX_HTTP_LUA_FFI_NO_REQ_CTX -100
@@ -318,6 +319,11 @@ union ngx_http_lua_srv_conf_u {
318319
ngx_str_t ssl_sess_fetch_src;
319320
u_char *ssl_sess_fetch_src_key;
320321
int ssl_sess_fetch_src_ref;
322+
323+
ngx_http_lua_srv_conf_handler_pt ssl_client_hello_handler;
324+
ngx_str_t ssl_client_hello_src;
325+
u_char *ssl_client_hello_src_key;
326+
int ssl_client_hello_src_ref;
321327
} srv;
322328
#endif
323329

‎src/ngx_http_lua_control.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -370,6 +370,7 @@ ngx_http_lua_ffi_exit(ngx_http_request_t *r, int status, u_char *err,
370370
| NGX_HTTP_LUA_CONTEXT_TIMER
371371
| NGX_HTTP_LUA_CONTEXT_HEADER_FILTER
372372
| NGX_HTTP_LUA_CONTEXT_BALANCER
373+
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO
373374
| NGX_HTTP_LUA_CONTEXT_SSL_CERT
374375
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE
375376
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH,
@@ -380,6 +381,7 @@ ngx_http_lua_ffi_exit(ngx_http_request_t *r, int status, u_char *err,
380381
}
381382

382383
if (ctx->context & (NGX_HTTP_LUA_CONTEXT_SSL_CERT
384+
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO
383385
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE
384386
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH))
385387
{

‎src/ngx_http_lua_ctx.c‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,7 @@ ngx_http_lua_ffi_get_ctx_ref(ngx_http_request_t *r, int *in_ssl_phase,
8888
}
8989

9090
*in_ssl_phase = ctx->context & (NGX_HTTP_LUA_CONTEXT_SSL_CERT
91+
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO
9192
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH
9293
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE);
9394
*ssl_ctx_ref = LUA_NOREF;
@@ -123,6 +124,7 @@ ngx_http_lua_ffi_set_ctx_ref(ngx_http_request_t *r, int ref)
123124

124125
#if (NGX_HTTP_SSL)
125126
if (ctx->context & (NGX_HTTP_LUA_CONTEXT_SSL_CERT
127+
| NGX_HTTP_LUA_CONTEXT_SSL_CLIENT_HELLO
126128
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_FETCH
127129
| NGX_HTTP_LUA_CONTEXT_SSL_SESS_STORE))
128130
{

‎src/ngx_http_lua_module.c‎

Lines changed: 59 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
#include "ngx_http_lua_probe.h"
2727
#include "ngx_http_lua_semaphore.h"
2828
#include "ngx_http_lua_balancer.h"
29+
#include "ngx_http_lua_ssl_client_helloby.h"
2930
#include "ngx_http_lua_ssl_certby.h"
3031
#include "ngx_http_lua_ssl_session_storeby.h"
3132
#include "ngx_http_lua_ssl_session_fetchby.h"
@@ -566,6 +567,20 @@ static ngx_command_t ngx_http_lua_cmds[] = {
566567
offsetof(ngx_http_lua_loc_conf_t, ssl_ciphers),
567568
NULL },
568569

570+
{ ngx_string("ssl_client_hello_by_lua_block"),
571+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_BLOCK|NGX_CONF_NOARGS,
572+
ngx_http_lua_ssl_client_hello_by_lua_block,
573+
NGX_HTTP_SRV_CONF_OFFSET,
574+
0,
575+
(void *) ngx_http_lua_ssl_client_hello_handler_inline },
576+
577+
{ ngx_string("ssl_client_hello_by_lua_file"),
578+
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_TAKE1,
579+
ngx_http_lua_ssl_client_hello_by_lua,
580+
NGX_HTTP_SRV_CONF_OFFSET,
581+
0,
582+
(void *) ngx_http_lua_ssl_client_hello_handler_file },
583+
569584
{ ngx_string("ssl_certificate_by_lua_block"),
570585
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_CONF_BLOCK|NGX_CONF_NOARGS,
571586
ngx_http_lua_ssl_cert_by_lua_block,
@@ -1086,6 +1101,10 @@ ngx_http_lua_create_srv_conf(ngx_conf_t *cf)
10861101
}
10871102

10881103
/* set by ngx_pcalloc:
1104+
* lscf->srv.ssl_client_hello_handler = NULL;
1105+
* lscf->srv.ssl_client_hello_src = { 0, NULL };
1106+
* lscf->srv.ssl_client_hello_src_key = NULL;
1107+
*
10891108
* lscf->srv.ssl_cert_handler = NULL;
10901109
* lscf->srv.ssl_cert_src = { 0, NULL };
10911110
* lscf->srv.ssl_cert_src_key = NULL;
@@ -1104,6 +1123,7 @@ ngx_http_lua_create_srv_conf(ngx_conf_t *cf)
11041123
*/
11051124

11061125
#if (NGX_HTTP_SSL)
1126+
lscf->srv.ssl_client_hello_src_ref = LUA_REFNIL;
11071127
lscf->srv.ssl_cert_src_ref = LUA_REFNIL;
11081128
lscf->srv.ssl_sess_store_src_ref = LUA_REFNIL;
11091129
lscf->srv.ssl_sess_fetch_src_ref = LUA_REFNIL;
@@ -1126,6 +1146,45 @@ ngx_http_lua_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
11261146

11271147
dd("merge srv conf");
11281148

1149+
if (conf->srv.ssl_client_hello_src.len == 0) {
1150+
conf->srv.ssl_client_hello_src = prev->srv.ssl_client_hello_src;
1151+
conf->srv.ssl_client_hello_src_ref = prev->srv.ssl_client_hello_src_ref;
1152+
conf->srv.ssl_client_hello_src_key = prev->srv.ssl_client_hello_src_key;
1153+
conf->srv.ssl_client_hello_handler = prev->srv.ssl_client_hello_handler;
1154+
}
1155+
1156+
if (conf->srv.ssl_client_hello_src.len) {
1157+
sscf = ngx_http_conf_get_module_srv_conf(cf, ngx_http_ssl_module);
1158+
if (sscf == NULL || sscf->ssl.ctx == NULL) {
1159+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
1160+
"no ssl configured for the server");
1161+
1162+
return NGX_CONF_ERROR;
1163+
}
1164+
#ifdef LIBRESSL_VERSION_NUMBER
1165+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
1166+
"LibreSSL does not support by ssl_client_hello_by_lua*");
1167+
return NGX_CONF_ERROR;
1168+
1169+
#else
1170+
1171+
#ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
1172+
1173+
SSL_CTX_set_client_hello_cb(sscf->ssl.ctx,
1174+
ngx_http_lua_ssl_client_hello_handler,
1175+
NULL);
1176+
1177+
#else
1178+
1179+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
1180+
"OpenSSL too old to support "
1181+
"ssl_client_hello_by_lua*");
1182+
return NGX_CONF_ERROR;
1183+
1184+
#endif
1185+
#endif
1186+
}
1187+
11291188
if (conf->srv.ssl_cert_src.len == 0) {
11301189
conf->srv.ssl_cert_src = prev->srv.ssl_cert_src;
11311190
conf->srv.ssl_cert_src_ref = prev->srv.ssl_cert_src_ref;

‎src/ngx_http_lua_ssl.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ typedef struct {
2525
ngx_str_t session_id;
2626

2727
int exit_code; /* exit code for openssl's
28+
set_client_hello_cb or
2829
set_cert_cb callback */
2930

3031
int ctx_ref; /* reference to anchor
@@ -34,6 +35,7 @@ typedef struct {
3435
unsigned done:1;
3536
unsigned aborted:1;
3637

38+
unsigned entered_client_hello_handler:1;
3739
unsigned entered_cert_handler:1;
3840
unsigned entered_sess_fetch_handler:1;
3941
} ngx_http_lua_ssl_ctx_t;

0 commit comments

Comments
 (0)