Skip to content

Commit 2d560cc

Browse files
AlinsRanAlinsRan
committedJan 20, 2025
feat: support set upstream ssl verify
1 parent 6658589 commit 2d560cc

File tree

6 files changed

+400
-6
lines changed

6 files changed

+400
-6
lines changed
 

‎lib/resty/apisix/upstream.lua

+36
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ ffi.cdef([[
1414
typedef intptr_t ngx_int_t;
1515
ngx_int_t ngx_http_apisix_upstream_set_cert_and_key(ngx_http_request_t *r, void *cert, void *key);
1616
ngx_int_t ngx_http_apisix_upstream_set_ssl_trusted_store(ngx_http_request_t *r, void *store);
17+
int ngx_http_apisix_upstream_set_ssl_verify(ngx_http_request_t *r, int verify);
1718
]])
1819
local _M = {}
1920

@@ -70,4 +71,39 @@ end
7071
_M.set_ssl_trusted_store = set_ssl_trusted_store
7172

7273

74+
local set_ssl_verify
75+
do
76+
local ALLOWED_PHASES = {
77+
['rewrite'] = true,
78+
['balancer'] = true,
79+
['access'] = true,
80+
['preread'] = true,
81+
}
82+
function set_ssl_verify(verify)
83+
if not ALLOWED_PHASES[get_phase()] then
84+
error("API disabled in the current context", 2)
85+
end
86+
87+
if type(verify) ~= 'boolean' then
88+
error("verify expects a boolean but found " .. type(verify), 2)
89+
end
90+
91+
local r = get_request()
92+
93+
local ret = C.ngx_http_apisix_upstream_set_ssl_verify(
94+
r, verify)
95+
if ret == NGX_OK then
96+
return true
97+
end
98+
99+
if ret == NGX_ERROR then
100+
return nil, "error while setting upstream ssl verify mode"
101+
end
102+
103+
error("unknown return code: " .. tostring(ret))
104+
end
105+
end
106+
_M.set_ssl_verify = set_ssl_verify
107+
108+
73109
return _M

‎patch/1.21.4/nginx-upstream_mtls.patch

+29-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
diff --git src/http/ngx_http_upstream.c src/http/ngx_http_upstream.c
2-
index 76045c4..cee3e2a 100644
2+
index 04d813a..c812242 100644
33
--- src/http/ngx_http_upstream.c
44
+++ src/http/ngx_http_upstream.c
55
@@ -8,6 +8,9 @@
@@ -10,9 +10,22 @@ index 76045c4..cee3e2a 100644
1010
+#include <ngx_http_apisix_module.h>
1111
+#endif
1212

13-
#if (T_NGX_MULTI_UPSTREAM)
14-
#include <ngx_http_multi_upstream_module.h>
15-
@@ -1766,6 +1769,10 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
13+
14+
#if (NGX_HTTP_CACHE)
15+
@@ -1697,8 +1700,11 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
16+
NGX_HTTP_INTERNAL_SERVER_ERROR);
17+
return;
18+
}
19+
-
20+
+#if (NGX_HTTP_APISIX)
21+
+ if (u->conf->ssl_server_name || ngx_http_apisix_get_upstream_ssl_verify(r, u->conf->ssl_verify)) {
22+
+#else
23+
if (u->conf->ssl_server_name || u->conf->ssl_verify) {
24+
+#endif
25+
if (ngx_http_upstream_ssl_name(r, u, c) != NGX_OK) {
26+
ngx_http_upstream_finalize_request(r, u,
27+
NGX_HTTP_INTERNAL_SERVER_ERROR);
28+
@@ -1738,6 +1744,10 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
1629

1730
r->connection->log->action = "SSL handshaking to upstream";
1831

@@ -23,3 +36,15 @@ index 76045c4..cee3e2a 100644
2336
rc = ngx_ssl_handshake(c);
2437

2538
if (rc == NGX_AGAIN) {
39+
@@ -1785,7 +1795,11 @@ ngx_http_upstream_ssl_handshake(ngx_http_request_t *r, ngx_http_upstream_t *u,
40+
41+
if (c->ssl->handshaked) {
42+
43+
+#if (NGX_HTTP_APISIX)
44+
+ if (ngx_http_apisix_get_upstream_ssl_verify(r, u->conf->ssl_verify)) {
45+
+#else
46+
if (u->conf->ssl_verify) {
47+
+#endif
48+
rc = SSL_get_verify_result(c->ssl->connection);
49+
50+
if (rc != X509_V_OK) {

‎patch/1.25.3.1/nginx-upstream_mtls.patch

+27-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
diff --git src/http/ngx_http_upstream.c src/http/ngx_http_upstream.c
2-
index 2be233c..78474f3 100644
2+
index 2be233c..06bbbb9 100644
33
--- src/http/ngx_http_upstream.c
44
+++ src/http/ngx_http_upstream.c
55
@@ -8,6 +8,9 @@
@@ -12,7 +12,20 @@ index 2be233c..78474f3 100644
1212

1313

1414
#if (NGX_HTTP_CACHE)
15-
@@ -1756,6 +1759,10 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
15+
@@ -1713,8 +1716,11 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
16+
NGX_HTTP_INTERNAL_SERVER_ERROR);
17+
return;
18+
}
19+
-
20+
+#if (NGX_HTTP_APISIX)
21+
+ if (u->conf->ssl_server_name || ngx_http_apisix_get_upstream_ssl_verify(r, u->conf->ssl_verify)) {
22+
+#else
23+
if (u->conf->ssl_server_name || u->conf->ssl_verify) {
24+
+#endif
25+
if (ngx_http_upstream_ssl_name(r, u, c) != NGX_OK) {
26+
ngx_http_upstream_finalize_request(r, u,
27+
NGX_HTTP_INTERNAL_SERVER_ERROR);
28+
@@ -1756,6 +1762,10 @@ ngx_http_upstream_ssl_init_connection(ngx_http_request_t *r,
1629

1730
r->connection->log->action = "SSL handshaking to upstream";
1831

@@ -23,3 +36,15 @@ index 2be233c..78474f3 100644
2336
rc = ngx_ssl_handshake(c);
2437

2538
if (rc == NGX_AGAIN) {
39+
@@ -1803,7 +1813,11 @@ ngx_http_upstream_ssl_handshake(ngx_http_request_t *r, ngx_http_upstream_t *u,
40+
41+
if (c->ssl->handshaked) {
42+
43+
+#if (NGX_HTTP_APISIX)
44+
+ if (ngx_http_apisix_get_upstream_ssl_verify(r, u->conf->ssl_verify)) {
45+
+#else
46+
if (u->conf->ssl_verify) {
47+
+#endif
48+
rc = SSL_get_verify_result(c->ssl->connection);
49+
50+
if (rc != X509_V_OK) {

‎src/ngx_http_apisix_module.c

+36
Original file line numberDiff line numberDiff line change
@@ -383,6 +383,42 @@ ngx_http_apisix_set_upstream_ssl(ngx_http_request_t *r, ngx_connection_t *c)
383383

384384
ngx_http_apisix_flush_ssl_error();
385385
}
386+
387+
388+
int
389+
ngx_http_apisix_upstream_set_ssl_verify(ngx_http_request_t *r, int verify)
390+
{
391+
ngx_http_apisix_ctx_t *ctx;
392+
393+
ctx = ngx_http_apisix_get_module_ctx(r);
394+
395+
if (ctx == NULL) {
396+
return NGX_ERROR;
397+
}
398+
399+
ctx->upstream_ssl_verify_set = 1;
400+
ctx->upstream_ssl_verify = verify;
401+
402+
return NGX_OK;
403+
}
404+
405+
ngx_flag_t
406+
ngx_http_apisix_get_upstream_ssl_verify(ngx_http_request_t *r, ngx_flag_t proxy_ssl_verify)
407+
{
408+
ngx_http_apisix_ctx_t *ctx;
409+
410+
ctx = ngx_http_apisix_get_module_ctx(r);
411+
412+
if (ctx == NULL) {
413+
return proxy_ssl_verify;
414+
}
415+
416+
if (!ctx->upstream_ssl_verify_set) {
417+
return proxy_ssl_verify;
418+
}
419+
420+
return ctx->upstream_ssl_verify;
421+
}
386422
#endif
387423

388424

‎src/ngx_http_apisix_module.h

+3
Original file line numberDiff line numberDiff line change
@@ -35,10 +35,13 @@ typedef struct {
3535
unsigned request_header_set:1;
3636
unsigned header_filter_by_lua_skipped:1;
3737
unsigned body_filter_by_lua_skipped:1;
38+
unsigned upstream_ssl_verify:1;
39+
unsigned upstream_ssl_verify_set:1;
3840
} ngx_http_apisix_ctx_t;
3941

4042

4143
void ngx_http_apisix_set_upstream_ssl(ngx_http_request_t *r, ngx_connection_t *c);
44+
ngx_flag_t ngx_http_apisix_get_upstream_ssl_verify(ngx_http_request_t *r, ngx_flag_t proxy_ssl_verify);
4245

4346
ngx_flag_t ngx_http_apisix_delay_client_max_body_check(ngx_http_request_t *r);
4447
off_t ngx_http_apisix_client_max_body_size(ngx_http_request_t *r);

0 commit comments

Comments
 (0)