cosocket: add function tcpsock:setclientcert, reimplemented tcpsock:sslhandshake with FFI. #1602
Conversation
dndx force-pushed the feat/cosocket_tlshandshake branch 5 times, most recently from a6c4f3e to b407ffb Compare dndx force-pushed the feat/cosocket_tlshandshake branch from b407ffb to 2d00cf6 Compare 
dndx force-pushed the feat/cosocket_tlshandshake branch 2 times, most recently from ac60ef5 to 6d2a474 Compare dndx force-pushed the feat/cosocket_tlshandshake branch from 6d2a474 to 9ccbe85 Compare 
| @@ -0,0 +1,439 @@ | |||
| # vim:set ft= ts=4 sw=4 et fdm=marker: | |||
There was a problem hiding this comment.
I am wondering if this new test suite belongs to lua-resty-core instead. After all, all FFI-based APIs are tested there, and not in lua-nginx-module.
There was a problem hiding this comment.
Yes I thought about this initially, but seems that this clear split is not being followed by existing tests like https://github.com/openresty/lua-nginx-module/blob/master/t/154-semaphore.t.
But, I don't have strong feeling about where to keep the cases, if moving is a better in your opinion then let's move it.
| This pull request is now in conflict :( |
| @dndx @kikito @thibaultcha thank you for the great work! ✌️ ✌️ |
thibaultcha force-pushed the feat/cosocket_tlshandshake branch from d618c47 to f1d1b63 Compare 
| I just rebased this PR (and sibling PR) on top of the latest master branch and fixed the conflicts now that OpenResty 1.17.8.1 has been released (for potential users of the patch). |
| @shtaif This PR is for cosocket connections only. For setting client certs to use in upstream connections, https://github.com/Kong/lua-kong-nginx-module#restykongtlsset_upstream_cert_and_key can do it. You just need to apply the required patches from https://github.com/Kong/kong-build-tools/blob/master/openresty-patches/patches/1.15.8.3/nginx-1.15.8_01-upstream_client_certificate_and_ssl_verify.patch. |
@dndx this was indeed the right way to go, thanks! |
| This pull request is now in conflict :( |
dndx changed the title tcpsock:tlshandshake, retired the Lua C API based tcpsock:sslhandshake implementation.tcpsock:setclientcert, reimplemented tcpsock:sslhandshake with FFI function. dndx changed the title tcpsock:setclientcert, reimplemented tcpsock:sslhandshake with FFI function.tcpsock:setclientcert, reimplemented tcpsock:sslhandshake with FFI. | @zhuizhuhaomeng the title has been changed. We can squash the change if you prefer. |
chronolaw force-pushed the feat/cosocket_tlshandshake branch 4 times, most recently from 004e4c2 to 53c0999 Compare dndx force-pushed the feat/cosocket_tlshandshake branch 2 times, most recently from 87d4259 to 220d9ee Compare …sslhandshake` with FFI This adds support for setting client certificate/private key that will be used later for mutual TLS handshake with a server. Also, the `tcpsock:sslhandshake` implementation has been rewritten to use FFI C API to be more performant and easier to maintain. Also see: openresty/lua-nginx-module#1602 Co-authored-by: Chrono Law <chrono.law@konghq.com>
dndx force-pushed the feat/cosocket_tlshandshake branch 2 times, most recently from 51e897f to d677c00 Compare …sslhandshake` with FFI This adds support for setting client certificate/private key that will be used later for mutual TLS handshake with a server. Also, the `tcpsock:sslhandshake` implementation has been rewritten to use FFI C API to be more performant and easier to maintain. Also see: openresty/lua-nginx-module#1602 Co-authored-by: Chrono Law <chrono.law@konghq.com>
| You can squash the changes. |
| @dndx would you please add the script to generate the mtls certificates to t/cert. |
…k:sslhandshake` with FFI This adds support for setting client certificate/private key that will be used later for mutual TLS handshake with a server. Also, the `tcpsock:sslhandshake` implementation has been rewritten to use FFI C API to be more performant and easier to maintain. Also see: openresty/lua-resty-core#278 Co-authored-by: Chrono Law <chrono.law@konghq.com>
dndx force-pushed the feat/cosocket_tlshandshake branch from d677c00 to fe1a1fe Compare Currently the script generates certs that are valid for 20 years, and should be enough for a while.
| @zhuizhuhaomeng The script has been added. One of the Travis run failed because of "negative credit balance" for Travis. However, considering the other build did passed, I think the new script generated certs should be good: https://app.travis-ci.com/github/openresty/lua-nginx-module/builds/247813268 |
| merged with the following patch |
| This pull request is now in conflict :( |
| Why this wasn't merged? |
In 1.21.4 openresty sock:handshake return cdata type instead of userdata Reference: openresty/lua-nginx-module#1602
In 1.21.4 openresty sock:handshake return cdata type instead of userdata Reference: openresty/lua-nginx-module#1602
12 participants
I hereby granted the copyright of the changes in this pull request
to the authors of this lua-nginx-module project.
Sister PR: openresty/lua-resty-core#278