Skip to content

Commit b94ebab

Browse files
nic-6443nic-6443
authored
feat: add api to get hostname of ssl session (#107)
Signed-off-by: Nic <[email protected]>
1 parent 463fab6 commit b94ebab

6 files changed

+356
-0
lines changed

‎patch/1.21.4/lua-resty-core-ssl_session_hostname.patch

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
diff --git lib/ngx/ssl.lua lib/ngx/ssl.lua
2+
index 8792be0..16b9c13 100644
3+
--- lib/ngx/ssl.lua
4+
+++ lib/ngx/ssl.lua
5+
@@ -26,6 +26,7 @@ local ngx_lua_ffi_ssl_set_der_private_key
6+
local ngx_lua_ffi_ssl_raw_server_addr
7+
local ngx_lua_ffi_ssl_server_port
8+
local ngx_lua_ffi_ssl_server_name
9+
+local ngx_lua_ffi_ssl_session_hostname
10+
local ngx_lua_ffi_ssl_raw_client_addr
11+
local ngx_lua_ffi_cert_pem_to_der
12+
local ngx_lua_ffi_priv_key_pem_to_der
13+
@@ -58,6 +59,9 @@ if subsystem == 'http' then
14+
int ngx_http_lua_ffi_ssl_server_name(ngx_http_request_t *r, char **name,
15+
size_t *namelen, char **err);
16+
17+
+ int ngx_http_lua_ffi_ssl_session_hostname(ngx_http_request_t *r, char **name,
18+
+ size_t *namelen, char **err);
19+
+
20+
int ngx_http_lua_ffi_ssl_raw_client_addr(ngx_http_request_t *r, char **addr,
21+
size_t *addrlen, int *addrtype, char **err);
22+
23+
@@ -97,6 +101,7 @@ if subsystem == 'http' then
24+
ngx_lua_ffi_ssl_raw_server_addr = C.ngx_http_lua_ffi_ssl_raw_server_addr
25+
ngx_lua_ffi_ssl_server_port = C.ngx_http_lua_ffi_ssl_server_port
26+
ngx_lua_ffi_ssl_server_name = C.ngx_http_lua_ffi_ssl_server_name
27+
+ ngx_lua_ffi_ssl_session_hostname = C.ngx_http_lua_ffi_ssl_session_hostname
28+
ngx_lua_ffi_ssl_raw_client_addr = C.ngx_http_lua_ffi_ssl_raw_client_addr
29+
ngx_lua_ffi_cert_pem_to_der = C.ngx_http_lua_ffi_cert_pem_to_der
30+
ngx_lua_ffi_priv_key_pem_to_der = C.ngx_http_lua_ffi_priv_key_pem_to_der
31+
@@ -129,6 +134,9 @@ elseif subsystem == 'stream' then
32+
int ngx_stream_lua_ffi_ssl_server_name(ngx_stream_lua_request_t *r,
33+
char **name, size_t *namelen, char **err);
34+
35+
+ int ngx_stream_lua_ffi_ssl_session_hostname(ngx_stream_lua_request_t *r,
36+
+ char **name, size_t *namelen, char **err);
37+
+
38+
int ngx_stream_lua_ffi_ssl_raw_client_addr(ngx_stream_lua_request_t *r,
39+
char **addr, size_t *addrlen, int *addrtype, char **err);
40+
41+
@@ -168,6 +176,7 @@ elseif subsystem == 'stream' then
42+
ngx_lua_ffi_ssl_raw_server_addr = C.ngx_stream_lua_ffi_ssl_raw_server_addr
43+
ngx_lua_ffi_ssl_server_port = C.ngx_stream_lua_ffi_ssl_server_port
44+
ngx_lua_ffi_ssl_server_name = C.ngx_stream_lua_ffi_ssl_server_name
45+
+ ngx_lua_ffi_ssl_session_hostname = C.ngx_stream_lua_ffi_ssl_session_hostname
46+
ngx_lua_ffi_ssl_raw_client_addr = C.ngx_stream_lua_ffi_ssl_raw_client_addr
47+
ngx_lua_ffi_cert_pem_to_der = C.ngx_stream_lua_ffi_cert_pem_to_der
48+
ngx_lua_ffi_priv_key_pem_to_der = C.ngx_stream_lua_ffi_priv_key_pem_to_der
49+
@@ -299,6 +308,27 @@ function _M.server_name()
50+
end
51+
52+
53+
+function _M.session_hostname()
54+
+ local r = get_request()
55+
+ if not r then
56+
+ error("no request found")
57+
+ end
58+
+
59+
+ local sizep = get_size_ptr()
60+
+
61+
+ local rc = ngx_lua_ffi_ssl_session_hostname(r, charpp, sizep, errmsg)
62+
+ if rc ~= FFI_OK then
63+
+ return nil, ffi_str(errmsg[0])
64+
+ end
65+
+
66+
+ if sizep[0] == 0 then
67+
+ return nil
68+
+ end
69+
+
70+
+ return ffi_str(charpp[0], sizep[0])
71+
+end
72+
+
73+
+
74+
function _M.raw_client_addr()
75+
local r = get_request()
76+
if not r then

‎patch/1.21.4/ngx_lua-ssl_session_hostname.patch

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
diff --git src/ngx_http_lua_ssl_certby.c src/ngx_http_lua_ssl_certby.c
2+
index b8e70dde..c3bfc790 100644
3+
--- src/ngx_http_lua_ssl_certby.c
4+
+++ src/ngx_http_lua_ssl_certby.c
5+
@@ -870,6 +870,46 @@ ngx_http_lua_ffi_ssl_server_name(ngx_http_request_t *r, char **name,
6+
}
7+
8+
9+
+int
10+
+ngx_http_lua_ffi_ssl_session_hostname(ngx_http_request_t *r, char **name,
11+
+ size_t *namelen, char **err)
12+
+{
13+
+ ngx_ssl_conn_t *ssl_conn;
14+
+
15+
+ if (r->connection == NULL || r->connection->ssl == NULL) {
16+
+ *err = "bad request";
17+
+ return NGX_ERROR;
18+
+ }
19+
+
20+
+ ssl_conn = r->connection->ssl->connection;
21+
+ if (ssl_conn == NULL) {
22+
+ *err = "bad ssl conn";
23+
+ return NGX_ERROR;
24+
+ }
25+
+
26+
+#if (defined(TLS1_3_VERSION) \
27+
+ && !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL))
28+
+
29+
+ /*
30+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
31+
+ * but servername being negotiated in every TLSv1.3 handshake
32+
+ * is only returned in OpenSSL 1.1.1+ as well
33+
+ */
34+
+
35+
+ *name = (char *) SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
36+
+
37+
+ if (*name) {
38+
+ *namelen = ngx_strlen(*name);
39+
+ return NGX_OK;
40+
+ }
41+
+#endif
42+
+
43+
+ *name = "";
44+
+ *namelen = 0;
45+
+ return NGX_OK;
46+
+}
47+
+
48+
+
49+
int
50+
ngx_http_lua_ffi_ssl_server_port(ngx_http_request_t *r,
51+
unsigned short *server_port, char **err)

‎patch/1.21.4/ngx_stream_lua-ssl_session_hostname.patch

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
diff --git src/ngx_stream_lua_ssl_certby.c src/ngx_stream_lua_ssl_certby.c
2+
index 7b4cc5b..3aa44bb 100644
3+
--- src/ngx_stream_lua_ssl_certby.c
4+
+++ src/ngx_stream_lua_ssl_certby.c
5+
@@ -882,6 +882,46 @@ ngx_stream_lua_ffi_ssl_server_name(ngx_stream_lua_request_t *r, char **name,
6+
}
7+
8+
9+
+int
10+
+ngx_stream_lua_ffi_ssl_session_hostname(ngx_stream_lua_request_t *r, char **name,
11+
+ size_t *namelen, char **err)
12+
+{
13+
+ ngx_ssl_conn_t *ssl_conn;
14+
+
15+
+ if (r->connection == NULL || r->connection->ssl == NULL) {
16+
+ *err = "bad request";
17+
+ return NGX_ERROR;
18+
+ }
19+
+
20+
+ ssl_conn = r->connection->ssl->connection;
21+
+ if (ssl_conn == NULL) {
22+
+ *err = "bad ssl conn";
23+
+ return NGX_ERROR;
24+
+ }
25+
+
26+
+#if (defined(TLS1_3_VERSION) \
27+
+ && !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL))
28+
+
29+
+ /*
30+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
31+
+ * but servername being negotiated in every TLSv1.3 handshake
32+
+ * is only returned in OpenSSL 1.1.1+ as well
33+
+ */
34+
+
35+
+ *name = (char *) SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
36+
+
37+
+ if (*name) {
38+
+ *namelen = ngx_strlen(*name);
39+
+ return NGX_OK;
40+
+ }
41+
+#endif
42+
+
43+
+ *name = "";
44+
+ *namelen = 0;
45+
+ return NGX_OK;
46+
+}
47+
+
48+
+
49+
int
50+
ngx_stream_lua_ffi_ssl_server_port(ngx_stream_lua_request_t *r,
51+
unsigned short *server_port, char **err)

‎patch/1.27.1.1/lua-resty-core-ssl_session_hostname.patch

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
diff --git lib/ngx/ssl.lua lib/ngx/ssl.lua
2+
index b696bea..ff1f251 100644
3+
--- lib/ngx/ssl.lua
4+
+++ lib/ngx/ssl.lua
5+
@@ -26,6 +26,7 @@ local ngx_lua_ffi_ssl_set_der_private_key
6+
local ngx_lua_ffi_ssl_raw_server_addr
7+
local ngx_lua_ffi_ssl_server_port
8+
local ngx_lua_ffi_ssl_server_name
9+
+local ngx_lua_ffi_ssl_session_hostname
10+
local ngx_lua_ffi_ssl_raw_client_addr
11+
local ngx_lua_ffi_cert_pem_to_der
12+
local ngx_lua_ffi_priv_key_pem_to_der
13+
@@ -64,6 +65,9 @@ if subsystem == 'http' then
14+
int ngx_http_lua_ffi_ssl_server_name(ngx_http_request_t *r, char **name,
15+
size_t *namelen, char **err);
16+
17+
+ int ngx_http_lua_ffi_ssl_session_hostname(ngx_http_request_t *r, char **name,
18+
+ size_t *namelen, char **err);
19+
+
20+
int ngx_http_lua_ffi_ssl_raw_client_addr(ngx_http_request_t *r, char **addr,
21+
size_t *addrlen, int *addrtype, char **err);
22+
23+
@@ -124,6 +128,7 @@ if subsystem == 'http' then
24+
ngx_lua_ffi_ssl_raw_server_addr = C.ngx_http_lua_ffi_ssl_raw_server_addr
25+
ngx_lua_ffi_ssl_server_port = C.ngx_http_lua_ffi_ssl_server_port
26+
ngx_lua_ffi_ssl_server_name = C.ngx_http_lua_ffi_ssl_server_name
27+
+ ngx_lua_ffi_ssl_session_hostname = C.ngx_http_lua_ffi_ssl_session_hostname
28+
ngx_lua_ffi_ssl_raw_client_addr = C.ngx_http_lua_ffi_ssl_raw_client_addr
29+
ngx_lua_ffi_cert_pem_to_der = C.ngx_http_lua_ffi_cert_pem_to_der
30+
ngx_lua_ffi_priv_key_pem_to_der = C.ngx_http_lua_ffi_priv_key_pem_to_der
31+
@@ -164,6 +169,9 @@ elseif subsystem == 'stream' then
32+
int ngx_stream_lua_ffi_ssl_server_name(ngx_stream_lua_request_t *r,
33+
char **name, size_t *namelen, char **err);
34+
35+
+ int ngx_stream_lua_ffi_ssl_session_hostname(ngx_stream_lua_request_t *r,
36+
+ char **name, size_t *namelen, char **err);
37+
+
38+
int ngx_stream_lua_ffi_ssl_raw_client_addr(ngx_stream_lua_request_t *r,
39+
char **addr, size_t *addrlen, int *addrtype, char **err);
40+
41+
@@ -212,6 +220,7 @@ elseif subsystem == 'stream' then
42+
ngx_lua_ffi_ssl_raw_server_addr = C.ngx_stream_lua_ffi_ssl_raw_server_addr
43+
ngx_lua_ffi_ssl_server_port = C.ngx_stream_lua_ffi_ssl_server_port
44+
ngx_lua_ffi_ssl_server_name = C.ngx_stream_lua_ffi_ssl_server_name
45+
+ ngx_lua_ffi_ssl_session_hostname = C.ngx_stream_lua_ffi_ssl_session_hostname
46+
ngx_lua_ffi_ssl_raw_client_addr = C.ngx_stream_lua_ffi_ssl_raw_client_addr
47+
ngx_lua_ffi_cert_pem_to_der = C.ngx_stream_lua_ffi_cert_pem_to_der
48+
ngx_lua_ffi_priv_key_pem_to_der = C.ngx_stream_lua_ffi_priv_key_pem_to_der
49+
@@ -346,6 +355,27 @@ function _M.server_name()
50+
end
51+
52+
53+
+function _M.session_hostname()
54+
+ local r = get_request()
55+
+ if not r then
56+
+ error("no request found")
57+
+ end
58+
+
59+
+ local sizep = get_size_ptr()
60+
+
61+
+ local rc = ngx_lua_ffi_ssl_session_hostname(r, charpp, sizep, errmsg)
62+
+ if rc ~= FFI_OK then
63+
+ return nil, ffi_str(errmsg[0])
64+
+ end
65+
+
66+
+ if sizep[0] == 0 then
67+
+ return nil
68+
+ end
69+
+
70+
+ return ffi_str(charpp[0], sizep[0])
71+
+end
72+
+
73+
+
74+
function _M.raw_client_addr()
75+
local r = get_request()
76+
if not r then

‎patch/1.27.1.1/ngx_lua-ssl_session_hostname.patch

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
diff --git src/ngx_http_lua_ssl_certby.c src/ngx_http_lua_ssl_certby.c
2+
index 72a651bd..7db28e10 100644
3+
--- src/ngx_http_lua_ssl_certby.c
4+
+++ src/ngx_http_lua_ssl_certby.c
5+
@@ -870,6 +870,46 @@ ngx_http_lua_ffi_ssl_server_name(ngx_http_request_t *r, char **name,
6+
}
7+
8+
9+
+int
10+
+ngx_http_lua_ffi_ssl_session_hostname(ngx_http_request_t *r, char **name,
11+
+ size_t *namelen, char **err)
12+
+{
13+
+ ngx_ssl_conn_t *ssl_conn;
14+
+
15+
+ if (r->connection == NULL || r->connection->ssl == NULL) {
16+
+ *err = "bad request";
17+
+ return NGX_ERROR;
18+
+ }
19+
+
20+
+ ssl_conn = r->connection->ssl->connection;
21+
+ if (ssl_conn == NULL) {
22+
+ *err = "bad ssl conn";
23+
+ return NGX_ERROR;
24+
+ }
25+
+
26+
+#if (defined(TLS1_3_VERSION) \
27+
+ && !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL))
28+
+
29+
+ /*
30+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
31+
+ * but servername being negotiated in every TLSv1.3 handshake
32+
+ * is only returned in OpenSSL 1.1.1+ as well
33+
+ */
34+
+
35+
+ *name = (char *) SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
36+
+
37+
+ if (*name) {
38+
+ *namelen = ngx_strlen(*name);
39+
+ return NGX_OK;
40+
+ }
41+
+#endif
42+
+
43+
+ *name = "";
44+
+ *namelen = 0;
45+
+ return NGX_OK;
46+
+}
47+
+
48+
+
49+
int
50+
ngx_http_lua_ffi_ssl_server_port(ngx_http_request_t *r,
51+
unsigned short *server_port, char **err)

‎patch/1.27.1.1/ngx_stream_lua-ssl_session_hostname.patch

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
diff --git src/ngx_stream_lua_ssl_certby.c src/ngx_stream_lua_ssl_certby.c
2+
index a34e187..0f65d82 100644
3+
--- src/ngx_stream_lua_ssl_certby.c
4+
+++ src/ngx_stream_lua_ssl_certby.c
5+
@@ -884,6 +884,46 @@ ngx_stream_lua_ffi_ssl_server_name(ngx_stream_lua_request_t *r, char **name,
6+
}
7+
8+
9+
+int
10+
+ngx_stream_lua_ffi_ssl_session_hostname(ngx_stream_lua_request_t *r, char **name,
11+
+ size_t *namelen, char **err)
12+
+{
13+
+ ngx_ssl_conn_t *ssl_conn;
14+
+
15+
+ if (r->connection == NULL || r->connection->ssl == NULL) {
16+
+ *err = "bad request";
17+
+ return NGX_ERROR;
18+
+ }
19+
+
20+
+ ssl_conn = r->connection->ssl->connection;
21+
+ if (ssl_conn == NULL) {
22+
+ *err = "bad ssl conn";
23+
+ return NGX_ERROR;
24+
+ }
25+
+
26+
+#if (defined(TLS1_3_VERSION) \
27+
+ && !defined(LIBRESSL_VERSION_NUMBER) && !defined(OPENSSL_IS_BORINGSSL))
28+
+
29+
+ /*
30+
+ * SSL_SESSION_get0_hostname() is only available in OpenSSL 1.1.1+,
31+
+ * but servername being negotiated in every TLSv1.3 handshake
32+
+ * is only returned in OpenSSL 1.1.1+ as well
33+
+ */
34+
+
35+
+ *name = (char *) SSL_SESSION_get0_hostname(SSL_get0_session(ssl_conn));
36+
+
37+
+ if (*name) {
38+
+ *namelen = ngx_strlen(*name);
39+
+ return NGX_OK;
40+
+ }
41+
+#endif
42+
+
43+
+ *name = "";
44+
+ *namelen = 0;
45+
+ return NGX_OK;
46+
+}
47+
+
48+
+
49+
int
50+
ngx_stream_lua_ffi_ssl_server_port(ngx_stream_lua_request_t *r,
51+
unsigned short *server_port, char **err)

0 commit comments

Comments
 (0)