fix: fetch secrets from upstream ssl config (#13062)

Author: cybersec-jochenarnold

apisix/cli/file.lua

@@ -342,7 +342,7 @@ function _M.read_yaml_conf(apisix_home)
             -- Therefore we need to check the absolute version instead
             local cert_path = pl_path.abspath(apisix_ssl.ssl_trusted_certificate)
             if not pl_path.exists(cert_path) then
-                util.die("certificate path", cert_path, "doesn't exist\n")
+                util.die("certificate path ", cert_path, " doesn't exist\n")
             end
             apisix_ssl.ssl_trusted_certificate = cert_path
         end

apisix/init.lua

@@ -564,6 +564,13 @@ local function resolve_upstream_client_cert(api_ctx)
 
     core.log.info("matched upstream client ssl object, id: ", cert_id,
                   ", type: ", upstream_ssl.type)
+
+    -- avoid the per-request deepcopy done by fetch_secrets when the ssl object
+    -- holds plain cert/key
+    if apisix_secret.has_secret_ref(upstream_ssl) then
+        upstream_ssl = apisix_secret.fetch_secrets(upstream_ssl, true) or upstream_ssl
+    end
+
     api_ctx.upstream_ssl = upstream_ssl
     return true
 end

apisix/ssl.lua

@@ -214,9 +214,11 @@ function _M.check_ssl_conf(in_dp, conf)
             return nil, "client tls verify unsupported"
         end
 
-        local ok, err = validate(conf.client.ca, nil)
-        if not ok then
-            return nil, "failed to validate client_cert: " .. err
+        if not secret.check_secret_uri(conf.client.ca) then
+            local ok, err = validate(conf.client.ca, nil)
+            if not ok then
+                return nil, "failed to validate client_cert: " .. err
+            end
         end
     end
 

apisix/ssl/router/radixtree_sni.lua

@@ -251,9 +251,9 @@ function _M.set(matched_ssl, sni)
         return false, err
     end
 
-    if matched_ssl.value.client then
-        local ca_cert = matched_ssl.value.client.ca
-        local depth = matched_ssl.value.client.depth
+    if new_ssl_value.client then
+        local ca_cert = new_ssl_value.client.ca
+        local depth = new_ssl_value.client.depth
         if apisix_ssl.support_client_verification() then
             local parsed_cert, err = apisix_ssl.fetch_cert(sni, ca_cert)
             if not parsed_cert then
@@ -262,7 +262,7 @@ function _M.set(matched_ssl, sni)
 
             local reject_in_handshake =
                 (ngx.config.subsystem == "stream") or
-                (matched_ssl.value.client.skip_mtls_uri_regex == nil)
+                (new_ssl_value.client.skip_mtls_uri_regex == nil)
             -- TODO: support passing `trusted_certs` (3rd arg, keep it nil for now)
             local ok, err = ngx_ssl.verify_client(parsed_cert, depth, nil,
                 reject_in_handshake)

docs/en/latest/terminology/secret.md

@@ -23,10 +23,10 @@ title: Secret
 
 ## Description
 
-Secrets refer to any sensitive information required during the running process of APISIX, which may be part of the core configuration (such as the etcd's password) or some sensitive information in the plugin. Common types of Secrets in APISIX include:
+Secrets refer to any sensitive information required during the running process of APISIX, which may be part of the core configuration (such as the etcd's password), cryptographic material or some sensitive information in the plugin. Common types of Secrets in APISIX include:
 
 - username, the password for some components (etcd, Redis, Kafka, etc.)
-- the private key of the certificate
+- the public certificate, private key and ca certificates
 - API key
 - Sensitive plugin configuration fields, typically used for authentication, hashing, signing, or encryption
 

docs/zh/latest/terminology/secret.md

@@ -23,10 +23,10 @@ title: Secret
 
 ## 描述
 
-密钥是指 APISIX 运行过程中所需的任何敏感信息，它可能是核心配置的一部分（如 etcd 的密码），也可能是插件中的一些敏感信息。APISIX 中常见的密钥类型包括：
+密钥是指 APISIX 运行过程中所需的任何敏感信息，它可能是核心配置的一部分（如 etcd 的密码）、加密材料，也可能是插件中的一些敏感信息。APISIX 中常见的密钥类型包括：
 
 - 一些组件（etcd、Redis、Kafka 等）的用户名、密码
-- 证书的私钥
+- 公钥证书、私钥和 CA 证书
 - API 密钥
 - 敏感的插件配置字段，通常用于身份验证、hash、签名或加密