Skip to content

Commit 0a77946

Browse files
caliocalio
committed
Merge branch 'hamishforbes-ssl-cosocket'
2 parents 12d4f29 + 0232315 commit 0a77946

File tree

5 files changed

+273
-5
lines changed

5 files changed

+273
-5
lines changed

‎README.md

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,6 +131,18 @@ Available user configurations are listed as follows:
131131

132132
Periodic flush interval (in seconds). Set to `nil` to turn off this feature.
133133

134+
* `ssl`
135+
136+
Boolean, enable or disable connecting via SSL. Default to false.
137+
138+
* `ssl_verify`
139+
140+
Boolean, enable or disable verifying host and certificate match. Default to true.
141+
142+
* `sni_host`
143+
144+
Set the hostname to send in SNI and to use when verifying certificate match.
145+
134146
[Back to TOC](#table-of-contents)
135147

136148
initted

‎lib/resty/logger/socket.lua

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,9 @@ local drop_limit = 1048576 -- 1MB
4949
local timeout = 1000 -- 1 sec
5050
local host
5151
local port
52+
local ssl = false
53+
local ssl_verify = true
54+
local sni_host
5255
local path
5356
local max_buffer_reuse = 10000 -- reuse buffer for at most 10000
5457
-- times
@@ -77,7 +80,7 @@ local pool_size = 10
7780
local flushing
7881
local logger_initted
7982
local counter = 0
80-
83+
local ssl_session
8184

8285
local function _write_error(msg)
8386
last_error = msg
@@ -110,6 +113,21 @@ local function _do_connect()
110113
return sock
111114
end
112115

116+
local function _do_handshake(sock)
117+
if not ssl then
118+
return sock
119+
end
120+
121+
local session, err = sock:sslhandshake(ssl_session, sni_host or host,
122+
ssl_verify)
123+
if not session then
124+
return nil, err
125+
end
126+
127+
ssl_session = session
128+
return sock
129+
end
130+
113131
local function _connect()
114132
local err, sock
115133

@@ -129,8 +147,11 @@ local function _connect()
129147
sock, err = _do_connect()
130148

131149
if sock then
132-
connected = true
133-
break
150+
sock, err = _do_handshake(sock)
151+
if sock then
152+
connected = true
153+
break
154+
end
134155
end
135156

136157
if debug then
@@ -360,6 +381,12 @@ function _M.init(user_config)
360381
max_buffer_reuse = v
361382
elseif k == "periodic_flush" then
362383
periodic_flush = v
384+
elseif k == "ssl" then
385+
ssl = v
386+
elseif k == "ssl_verify" then
387+
ssl_verify = v
388+
elseif k == "sni_host" then
389+
sni_host = v
363390
end
364391
end
365392

‎t/cert/test.crt

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDgzCCAmugAwIBAgIJALyCyaxg9zbFMA0GCSqGSIb3DQEBBQUAMFgxCzAJBgNV
3+
BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEwHwYDVQQKDBhJbnRlcm5ldCBX
4+
aWRnaXRzIFB0eSBMdGQxETAPBgNVBAMMCHRlc3QuY29tMB4XDTE1MDIwOTIwMDEy
5+
M1oXDTE2MDIwOTIwMDEyM1owWDELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUt
6+
U3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDERMA8GA1UE
7+
AwwIdGVzdC5jb20wggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDtWTKs
8+
uFmcJcwQizcCHQXWXZO62h1IOuuE2+lygpJTjHgVeFniH7hRiXWLviza0RdvBx1j
9+
eTy1/OVGPOZo/mFNVkAQ4h3YBNphQxwlXIj+tzLH6/OPozKj+JsKXJU9VrBSyw2W
10+
KR1G+F+9NmEuteH361YR3O1WUrWuihCgXGc3VXevEyS4rjvu4pV8x73LUQJ7Hphm
11+
/rm9mAuLSXIDIZMewgg5lQKbVTEYKJppdLv0GztLztXmuNzD7ohmbksHfzCwPJ7b
12+
d4kdDeivVj+mw//TShWgDGSs/VkUbGrLjJ6wJBM84jbnlJuMEQezlFsCQbgv+AK5
13+
ypR6ZpcPkhfeaimHAgMBAAGjUDBOMB0GA1UdDgQWBBT07/1maBvi4l1OsOtj/pow
14+
F91UhzAfBgNVHSMEGDAWgBT07/1maBvi4l1OsOtj/powF91UhzAMBgNVHRMEBTAD
15+
AQH/MA0GCSqGSIb3DQEBBQUAA4IBAQBSQKKiuE9zAb3QsCPAgqW+XmPVSoMcAdfV
16+
/cJCLkGWnEUsiCX+D7M4+BqDxj4tnWXfwUD8kk86w1KCMTCyVSZXT9ru99RFaPF/
17+
/VGXXxXAQGcck3RqoURct4vcK1M5JJI7+89bu2gP9SbeFebPN+eaVaSdVyEAU3WU
18+
IA+2Oa1GDrVMG/ilJvG2g7ON0R21L5CggiPleYPEf9ACqN+QgCq3ms+6jwTs4L2n
19+
DPzRmgjvnEU8XOnt30SiEzWsBlOf54kIsyypBGEeHOqJhbIPpp2N7CDkz4Hzjh4S
20+
pwjA69Xy5W+MfiL/Swd+uzatmylAswM/Tuw4P7Levd7QdT8HLvt+
21+
-----END CERTIFICATE-----

‎t/cert/test.key

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,28 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDtWTKsuFmcJcwQ
3+
izcCHQXWXZO62h1IOuuE2+lygpJTjHgVeFniH7hRiXWLviza0RdvBx1jeTy1/OVG
4+
POZo/mFNVkAQ4h3YBNphQxwlXIj+tzLH6/OPozKj+JsKXJU9VrBSyw2WKR1G+F+9
5+
NmEuteH361YR3O1WUrWuihCgXGc3VXevEyS4rjvu4pV8x73LUQJ7Hphm/rm9mAuL
6+
SXIDIZMewgg5lQKbVTEYKJppdLv0GztLztXmuNzD7ohmbksHfzCwPJ7bd4kdDeiv
7+
Vj+mw//TShWgDGSs/VkUbGrLjJ6wJBM84jbnlJuMEQezlFsCQbgv+AK5ypR6ZpcP
8+
khfeaimHAgMBAAECggEACY3Dmmw5Py3OTwQrjKw6ZeySW70X3KZygICRnwhed3p6
9+
AvM7Ovzn4HBWCO/4wj4UYWW56x0gMnshh3hAFg3XQNOt9IAFj4Jyf+PBqEdXRFl/
10+
c8itnySEj1EcfIhJgZSRuGNwApFZGlg5Ela0BrtPgzk317Q64XSm14W7MZlGllWI
11+
iZZEh1q1TTA1CfroLjK0XOQqK+EQwkNuKca4T8YytcJVG6eSJApoYf0pKNVgRTnW
12+
tFAa3TrzxqhEEfw4dlIce6kTrGrNxhb2QZ2OeoYzsO140bn+yXs80a8reIxSWpzK
13+
lag6rMkonKCmKi8cU1HQbKbLPskteXs+Fx+PzJKlMQKBgQD3Jn/GN/S4TRpEw6R7
14+
CgsVZ/rhBGaYB2lEyYOb72Ex7BQFFAiqDes9EEssvd+0baRnVxkd0GCGtbF0laor
15+
ogDTDLuYv8VCaBmWZAy8aFhZbT8ygLjAjhOU1p5PWXgngyj+cPo5K0Hj1W/xCDcv
16+
0bmjhFguHlx1M6hhPO7ABYYjewKBgQD12NlsUdRttdIxEaV6KA2WKcvi2zIspUdi
17+
TBIaiq1P7a2KO2oDMStqlDvWSIvM2kyGHM6kWuAZWC5zSBndjHMH3+hXrHBEreVX
18+
3dcvx2El/3O36zuGSEBMye/EIlSe323dPohGObgW1iSaLdw+8dP+TiaJV6coh03g
19+
MffgFTVeZQKBgQD1a196P9pcoQOywOu12jVDXmt7wlj2InXf/pMX508GubzvhgNM
20+
imHL00Ay/6ECk9WrYIvqVR9k5Ut/z5aZmVdkO8KVXejNln3CHzueY6dHtfoJdlT/
21+
sJW1OKEffmKYKeAtOZbf6hqV2T49hMD4VTQYMbU2pqN9JnzPgig6ucGHvQKBgDpn
22+
TpeWBQIfLJTtnUMc2sVunnoBGrVSelfWvIJDqZKQYyawoKmrd6X1GxX33AZJYd6G
23+
X2zaDdzXfwlx+nsQT49yWM7jLzSRnyc1k1ZNZj3RptrtbhGjfmr/mg8dHL81UvM5
24+
VMRiF+KM8tsRw/3ME1GZnTwJb7OIGS8Gj91TDH+lAoGBAO/noqWfPpKlWB3gjj5q
25+
mUZXyHiqo7Rze5cLCif2CBt3GIhT/XS97kCJZLbWRUC/Hy7ncTtq/aATmqKkhr2U
26+
Uov2oz0B64/L89Ymy0KsAJczdoKWEd5A+Wg1uW+yju01Ds0sO3uW1HQJlqxPTTDE
27+
cMyz91ugbaoCZV877haZMklH
28+
-----END PRIVATE KEY-----

‎t/sanity.t

Lines changed: 182 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,10 +5,10 @@ use Cwd qw(cwd);
55

66
repeat_each(2);
77

8-
plan tests => repeat_each() * (blocks() * 4 + 5);
8+
plan tests => repeat_each() * (blocks() * 4 + 4);
99
our $HtmlDir = html_dir;
1010

11-
my $pwd = cwd();
11+
our $pwd = cwd();
1212

1313
our $HttpConfig = qq{
1414
lua_package_path "$pwd/lib/?.lua;;";
@@ -699,3 +699,183 @@ GET /t
699699
foo
700700
wrote bytes: 3
701701
wrote bytes: 3
702+
703+
704+
705+
=== TEST 17: SSL logging
706+
--- http_config eval
707+
"
708+
lua_package_path '$::pwd/lib/?.lua;;';
709+
server {
710+
listen unix:$::HtmlDir/ssl.sock ssl;
711+
server_name test.com;
712+
ssl_certificate $::pwd/t/cert/test.crt;
713+
ssl_certificate_key $::pwd/t/cert/test.key;
714+
715+
location /test {
716+
lua_need_request_body on;
717+
default_type 'text/plain';
718+
# 204 No content
719+
content_by_lua '
720+
ngx.log(ngx.WARN, \"Message received: \", ngx.var.http_message)
721+
ngx.log(ngx.WARN, \"SNI Host: \", ngx.var.ssl_server_name)
722+
ngx.exit(204)
723+
';
724+
}
725+
}
726+
"
727+
--- config
728+
location /t {
729+
content_by_lua '
730+
ngx.say("foo")
731+
local logger = require "resty.logger.socket"
732+
if not logger.initted() then
733+
local ok, err = logger.init{
734+
path = "$TEST_NGINX_HTML_DIR/ssl.sock",
735+
flush_limit = 1,
736+
drop_limit = 10000,
737+
retry_interval = 1,
738+
timeout = 50,
739+
ssl = true,
740+
ssl_verify = false,
741+
sni_host = "test.com",
742+
}
743+
end
744+
745+
local bytes, err
746+
bytes, err = logger.log("GET /test HTTP/1.0\\r\\nHost: test.com\\r\\nConnection: close\\r\\nMessage: Hello SSL\\r\\n\\r\\n")
747+
if err then
748+
ngx.log(ngx.ERR, err)
749+
end
750+
ngx.say("wrote bytes: ", bytes)
751+
752+
ngx.sleep(0.05)
753+
';
754+
}
755+
--- request
756+
GET /t
757+
--- wait: 0.1
758+
--- response_body
759+
foo
760+
wrote bytes: 77
761+
--- error_log
762+
Message received: Hello SSL
763+
SNI Host: test.com
764+
765+
766+
767+
=== TEST 18: SSL logging - Verify
768+
--- http_config eval
769+
"
770+
lua_package_path '$::pwd/lib/?.lua;;';
771+
server {
772+
listen unix:$::HtmlDir/ssl.sock ssl;
773+
server_name test.com;
774+
ssl_certificate $::pwd/t/cert/test.crt;
775+
ssl_certificate_key $::pwd/t/cert/test.key;
776+
777+
location /test {
778+
lua_need_request_body on;
779+
default_type 'text/plain';
780+
# 204 No content
781+
content_by_lua 'ngx.log(ngx.WARN, \"Message received: \", ngx.var.http_message) ngx.exit(204)';
782+
}
783+
}
784+
"
785+
--- config
786+
location /t {
787+
content_by_lua '
788+
ngx.say("foo")
789+
local logger = require "resty.logger.socket"
790+
if not logger.initted() then
791+
local ok, err = logger.init{
792+
path = "$TEST_NGINX_HTML_DIR/ssl.sock",
793+
flush_limit = 1,
794+
drop_limit = 10000,
795+
retry_interval = 1,
796+
timeout = 50,
797+
ssl = true,
798+
ssl_verify = true,
799+
sni_host = "test.com",
800+
}
801+
end
802+
803+
local bytes, err
804+
bytes, err = logger.log("GET /test HTTP/1.0\\r\\nHost: test.com\\r\\nConnection: close\\r\\nMessage: Hello SSL\\r\\n\\r\\n")
805+
if err then
806+
ngx.log(ngx.ERR, err)
807+
end
808+
ngx.say("wrote bytes: ", bytes)
809+
810+
ngx.sleep(0.05)
811+
';
812+
}
813+
--- request
814+
GET /t
815+
--- wait: 0.1
816+
--- response_body
817+
foo
818+
wrote bytes: 77
819+
--- error_log
820+
lua ssl certificate verify error
821+
822+
823+
824+
=== TEST 19: SSL logging - No SNI
825+
--- http_config eval
826+
"
827+
lua_package_path '$::pwd/lib/?.lua;;';
828+
server {
829+
listen unix:$::HtmlDir/ssl.sock ssl;
830+
server_name test.com;
831+
ssl_certificate $::pwd/t/cert/test.crt;
832+
ssl_certificate_key $::pwd/t/cert/test.key;
833+
834+
location /test {
835+
lua_need_request_body on;
836+
default_type 'text/plain';
837+
# 204 No content
838+
content_by_lua '
839+
ngx.log(ngx.WARN, \"Message received: \", ngx.var.http_message)
840+
ngx.log(ngx.WARN, \"SNI Host: \", ngx.var.ssl_server_name)
841+
ngx.exit(204)
842+
';
843+
}
844+
}
845+
"
846+
--- config
847+
location /t {
848+
content_by_lua '
849+
ngx.say("foo")
850+
local logger = require "resty.logger.socket"
851+
if not logger.initted() then
852+
local ok, err = logger.init{
853+
path = "$TEST_NGINX_HTML_DIR/ssl.sock",
854+
flush_limit = 1,
855+
drop_limit = 10000,
856+
retry_interval = 1,
857+
timeout = 50,
858+
ssl = true,
859+
ssl_verify = false,
860+
}
861+
end
862+
863+
local bytes, err
864+
bytes, err = logger.log("GET /test HTTP/1.0\\r\\nHost: test.com\\r\\nConnection: close\\r\\nMessage: Hello SSL\\r\\n\\r\\n")
865+
if err then
866+
ngx.log(ngx.ERR, err)
867+
end
868+
ngx.say("wrote bytes: ", bytes)
869+
870+
ngx.sleep(0.05)
871+
';
872+
}
873+
--- request
874+
GET /t
875+
--- wait: 0.1
876+
--- response_body
877+
foo
878+
wrote bytes: 77
879+
--- error_log
880+
Message received: Hello SSL
881+
SNI Host: nil

0 commit comments

Comments
 (0)