tools/openresty
1
0
Fork 0
mirror of https://github.com/openresty/openresty.git synced 2026-03-13 09:20:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

feature: proxy_ssl_verify_by_lua directives.

Browse Source
This commit is contained in:
willmafh
2025-10-14 13:13:24 +08:00
committed by GitHub
parent 305ebd07e3
commit d08b0f1f44
2 changed files with 72 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

65
patches/nginx/1.27.1/nginx-1.27.1-proxy_ssl_verify_cb_yield.patch Normal file
View File

@@ -0,0 +1,65 @@
diff --git a/src/event/ngx_event_openssl.c b/src/event/ngx_event_openssl.c
index 9e8f424..8be4537 100644
--- a/src/event/ngx_event_openssl.c
+++ b/src/event/ngx_event_openssl.c
@@ -1921,6 +1921,9 @@ ngx_ssl_handshake(ngx_connection_t *c)
# endif
# ifdef SSL_ERROR_WANT_CLIENT_HELLO_CB
|| sslerr == SSL_ERROR_WANT_CLIENT_HELLO_CB
+# endif
+# ifdef SSL_ERROR_WANT_RETRY_VERIFY
+ || sslerr == SSL_ERROR_WANT_RETRY_VERIFY
# endif
)
{
@@ -2135,6 +2138,23 @@ ngx_ssl_try_early_data(ngx_connection_t *c)
}
#endif
+#ifdef SSL_ERROR_WANT_RETRY_VERIFY
+ if (sslerr == SSL_ERROR_WANT_RETRY_VERIFY) {
+ c->read->handler = ngx_ssl_handshake_handler;
+ c->write->handler = ngx_ssl_handshake_handler;
+
+ if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
+ return NGX_ERROR;
+ }
+
+ return NGX_AGAIN;
+ }
+#endif
+
err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;
c->ssl->no_wait_shutdown = 1;
diff --git a/src/event/ngx_event_openssl.h b/src/event/ngx_event_openssl.h
index ebb2c35..0eaaa83 100644
--- a/src/event/ngx_event_openssl.h
+++ b/src/event/ngx_event_openssl.h
@@ -83,6 +83,9 @@
#endif
+#define HAVE_PROXY_SSL_PATCH 1
+
+
typedef struct ngx_ssl_ocsp_s ngx_ssl_ocsp_t;
diff --git a/src/stream/ngx_stream_proxy_module.c b/src/stream/ngx_stream_proxy_module.c
index 82dca1e..ba0cbe3 100644
--- a/src/stream/ngx_stream_proxy_module.c
+++ b/src/stream/ngx_stream_proxy_module.c
@@ -2293,7 +2293,7 @@ ngx_stream_proxy_set_ssl(ngx_conf_t *cf, ngx_stream_proxy_srv_conf_t *pscf)
return NGX_OK;
}
- if (ngx_ssl_create(pscf->ssl, pscf->ssl_protocols, NULL) != NGX_OK) {
+ if (ngx_ssl_create(pscf->ssl, pscf->ssl_protocols, pscf) != NGX_OK) {
return NGX_ERROR;
}

7
util/mirror-tarballs
View File

@@ -493,6 +493,13 @@ if [ "$answer" = "Y" ]; then
echo
fi
answer=`$root/util/ver-ge "$main_ver" 1.27.1`
if [ "$answer" = "Y" ]; then
echo "$info_txt applying the proxy_ssl_verify_cb_yield.patch patch to nginx"
patch -p1 < $root/patches/nginx/$main_ver/nginx-$main_ver-proxy_ssl_verify_cb_yield.patch
echo
fi
answer=`$root/util/ver-ge "$main_ver" 0.6.18`
if [ "$answer" = "Y" ]; then
answer=`$root/util/ver-ge "$main_ver" 1.20.1`