1- local ffi = require (" ffi" )
2- local base = require (" resty.core.base" )
1+ -- Copyright (C) by OpenResty Inc.
2+
3+
4+ local base = require " resty.core.base"
5+ local ffi = require " ffi"
6+
37
48local C = ffi .C
5- local ffi_string = ffi .string
9+ local ffi_str = ffi .string
610local ffi_gc = ffi .gc
711local FFI_ERROR = base .FFI_ERROR
812local FFI_DONE = base .FFI_DONE
913local FFI_OK = base .FFI_OK
1014local FFI_AGAIN = base .FFI_AGAIN
1115local FFI_NO_REQ_CTX = base .FFI_NO_REQ_CTX
1216local get_request = base .get_request
17+ local new_tab = base .new_tab
18+ local clear_tab = base .clear_tab
1319local error = error
1420local assert = assert
1521local type = type
1622local pcall = pcall
1723local select = select
1824local co_yield = coroutine ._yield
19- local table_new = require (" table.new" )
20- local table_clear = require (" table.clear" )
25+
2126
2227ffi .cdef [[
2328typedef struct ngx_http_lua_socket_tcp_upstream_s
@@ -26,11 +31,12 @@ typedef struct ngx_http_lua_socket_tcp_upstream_s
2631int ngx_http_lua_ffi_socket_tcp_tlshandshake (ngx_http_request_t * r ,
2732 ngx_http_lua_socket_tcp_upstream_t * u , void * sess ,
2833 int enable_session_reuse , ngx_str_t * server_name , int verify ,
29- int ocsp_status_req , void * chain , void * pkey ,
30- char ** errmsg );
34+ int ocsp_status_req , void * chain , void * pkey , char ** errmsg );
35+
3136int ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (ngx_http_request_t * r ,
32- ngx_http_lua_socket_tcp_upstream_t * u , void ** sess ,
33- char ** errmsg , int * openssl_error_code );
37+ ngx_http_lua_socket_tcp_upstream_t * u , void ** sess , char ** errmsg ,
38+ int * openssl_error_code );
39+
3440void ngx_http_lua_ffi_tls_free_session (void * sess );
3541]]
3642
@@ -42,22 +48,21 @@ local errmsg = base.get_errmsg_ptr()
4248local session_ptr = ffi .new (" void *[1]" )
4349local server_name_str = ffi .new (" ngx_str_t[1]" )
4450local openssl_error_code = ffi .new (" int[1]" )
45- local cached_options = table_new (0 , 4 )
51+ local cached_options = new_tab (0 , 4 )
4652
4753
4854local function tlshandshake (self , options )
4955 if not options then
50- table_clear (cached_options )
56+ clear_tab (cached_options )
5157 options = cached_options
5258
5359 elseif type (options ) ~= " table" then
54- error (" bad options table type " )
60+ error (" bad options arg: table expected " , 2 )
5561 end
5662
5763 local r = get_request ()
58-
5964 if not r then
60- error (" no request found" )
65+ error (" no request found" , 2 )
6166 end
6267
6368 local reused_session = options .reused_session
@@ -73,77 +78,73 @@ local function tlshandshake(self, options)
7378 end
7479
7580 local client_cert = options .client_cert
76- local client_priv_key = options .client_priv_key
81+ local client_pkey = options .client_priv_key
7782 if client_cert then
78- if not client_priv_key then
79- error (" client certificate supplied without "
80- .. " corresponding private key" , 2 )
83+ if not client_pkey then
84+ error (" client certificate supplied without corresponding " ..
85+ " private key" , 2 )
8186 end
8287
83- if type (client_cert ) ~= " cdata"
84- or type (client_priv_key ) ~= " cdata"
85- then
86- error (" wrong type of client certificate or private key supplied" , 2 )
88+ if type (client_cert ) ~= " cdata" then
89+ error (" bad client_cert option type" , 2 )
90+ end
91+
92+ if type (client_pkey ) ~= " cdata" then
93+ error (" bad client_priv_key option type" , 2 )
8794 end
8895 end
8996
90- local rc =
91- C .ngx_http_lua_ffi_socket_tcp_tlshandshake (r , self [SOCKET_CTX_INDEX ],
92- session_ptr [0 ],
93- reused_session ~= false ,
94- server_name_str ,
95- options .verify and 1 or 0 ,
96- options .ocsp_status_req
97- and 1 or 0 ,
98- client_cert ,
99- client_priv_key ,
100- errmsg )
97+ local u = self [SOCKET_CTX_INDEX ]
98+
99+ local rc = C .ngx_http_lua_ffi_socket_tcp_tlshandshake (r , u ,
100+ session_ptr [0 ],
101+ reused_session ~= false ,
102+ server_name_str ,
103+ options .verify and 1 or 0 ,
104+ options .ocsp_status_req and 1 or 0 ,
105+ client_cert , client_pkey , errmsg )
101106
102107 if rc == FFI_NO_REQ_CTX then
103108 error (" no request ctx found" , 2 )
104109 end
105110
106- :: again::
111+ while true do
112+ if rc == FFI_ERROR then
113+ if openssl_error_code [0 ] ~= 0 then
114+ return nil , openssl_error_code [0 ] .. " : " .. ffi_str (errmsg [0 ])
115+ end
107116
108- if rc == FFI_ERROR then
109- if openssl_error_code [0 ] ~= 0 then
110- return nil , openssl_error_code [0 ] .. " : " .. ffi_string (errmsg [0 ])
117+ return nil , ffi_str (errmsg [0 ])
111118 end
112119
113- return nil , ffi_string (errmsg [0 ])
114- end
115-
116- if rc == FFI_DONE then
117- return options .reused_session
118- end
119-
120- if rc == FFI_OK then
121- if options .reused_session == false then
122- return true
120+ if rc == FFI_DONE then
121+ return reused_session
123122 end
124123
125- rc = C . ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result ( r ,
126- self [ SOCKET_CTX_INDEX ], session_ptr , errmsg , openssl_error_code )
127-
128- assert ( rc == FFI_OK )
124+ if rc == FFI_OK then
125+ if reused_session == false then
126+ return true
127+ end
129128
130- if session_ptr [0 ] == nil then
131- return session_ptr [0 ]
132- end
129+ rc = C .ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (r , u ,
130+ session_ptr , errmsg , openssl_error_code )
133131
134- return ffi_gc (session_ptr [0 ], C .ngx_http_lua_ffi_tls_free_session )
135- end
132+ assert (rc == FFI_OK )
136133
137- assert (rc == FFI_AGAIN )
134+ if session_ptr [0 ] == nil then
135+ return nil
136+ end
138137
139- co_yield ()
138+ return ffi_gc (session_ptr [0 ], C .ngx_http_lua_ffi_tls_free_session )
139+ end
140140
141- rc = C .ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (r ,
142- self [SOCKET_CTX_INDEX ], session_ptr , errmsg , openssl_error_code )
141+ assert (rc == FFI_AGAIN )
143142
144- assert ( rc == FFI_OK or rc == FFI_ERROR )
143+ co_yield ( )
145144
146- goto again
145+ rc = C .ngx_http_lua_ffi_socket_tcp_get_tlshandshake_result (r , u ,
146+ session_ptr , errmsg , openssl_error_code )
147+ end
147148end
148149
149150
@@ -152,8 +153,8 @@ local function sslhandshake(self, reused_session, server_name, ssl_verify,
152153
153154 local n = select (" #" , ... )
154155 if not self or n > 1 then
155- error (" ngx.socket sslhandshake: expecting 1 ~ 5 "
156- .. " arguments (including the object), but seen " .. n )
156+ error (" ngx.socket sslhandshake: expecting 1 ~ 5 arguments " ..
157+ " (including the object), but seen " .. ( self and 5 + n or 0 ) )
157158 end
158159
159160 cached_options .reused_session = reused_session
@@ -162,7 +163,8 @@ local function sslhandshake(self, reused_session, server_name, ssl_verify,
162163 cached_options .ocsp_status_req = send_status_req
163164
164165 local res , err = tlshandshake (self , cached_options )
165- table_clear (cached_options )
166+
167+ clear_tab (cached_options )
166168
167169 return res , err
168170end
0 commit comments