You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by sp...@apache.org on 2022/05/18 09:30:28 UTC
[apisix] branch release/2.13 updated (a22336785 -> e95da8906)
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a change to branch release/2.13
in repository https://gitbox.apache.org/repos/asf/apisix.git
from a22336785 chore(jwt-auth): adjust error log level to warn (#6860)
new 748e8fe5a ci: make it pass under OpenResty 1.21 (#7067)
new 0c73489e7 ci(traffic-split): improve ci stability (#7055)
new 80b6b2d21 fix: the client verify flag might not be set (#6906)
new 047f77050 perf: avoid rematching SSL when our customized Nginx is used (#6970)
new e95da8906 test: reject bad client TLS request in handshake (#6941)
The 5 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
apisix/init.lua | 36 +++++++++++++++++++++++++++---------
apisix/ssl/router/radixtree_sni.lua | 8 +++++---
bin/apisix | 10 +++++-----
t/node/client-mtls.t | 8 ++++----
t/plugin/traffic-split.t | 12 +++++++-----
utils/linux-install-luarocks.sh | 4 ++--
6 files changed, 50 insertions(+), 28 deletions(-)
[apisix] 05/05: test: reject bad client TLS request in handshake (#6941)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.13
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit e95da89064b5762f04ef61ad98990ccc8577d69c
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Wed Apr 27 11:25:34 2022 +0800
test: reject bad client TLS request in handshake (#6941)
---
t/node/client-mtls.t | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/t/node/client-mtls.t b/t/node/client-mtls.t
index b1cd22581..afccc9375 100644
--- a/t/node/client-mtls.t
+++ b/t/node/client-mtls.t
@@ -244,9 +244,9 @@ GET /t
GET /mtls2
--- more_headers
Host: localhost
---- error_code: 400
+--- error_code: 502
--- error_log
-client certificate was not present
+peer did not return a certificate
@@ -301,6 +301,6 @@ GET /t
GET /mtls3
--- more_headers
Host: localhost
---- error_code: 400
+--- error_code: 502
--- error_log
-client certificate verification is not passed: FAILED:self signed certificate
+certificate verify failed
[apisix] 04/05: perf: avoid rematching SSL when our customized Nginx is used (#6970)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.13
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 047f770508d8a76b307f6d16f1582ac4e5a56747
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Thu May 5 14:12:26 2022 +0800
perf: avoid rematching SSL when our customized Nginx is used (#6970)
Signed-off-by: spacewander <sp...@gmail.com>
---
apisix/init.lua | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/apisix/init.lua b/apisix/init.lua
index 4717646de..a2eb17d1c 100644
--- a/apisix/init.lua
+++ b/apisix/init.lua
@@ -63,6 +63,11 @@ if ngx.config.subsystem == "http" then
control_api_router = require("apisix.control.router")
end
+local ok, apisix_base_flags = pcall(require, "resty.apisix.patch")
+if not ok then
+ apisix_base_flags = {}
+end
+
local load_balancer
local local_conf
local ver_header = "APISIX/" .. core.version.VERSION
@@ -310,6 +315,12 @@ end
local function verify_tls_client(ctx)
+ if apisix_base_flags.client_cert_verified_in_handshake then
+ -- For apisix-base, there is no need to rematch SSL rules as the invalid
+ -- connections are already rejected in the handshake
+ return true
+ end
+
local matched = router.router_ssl.match_and_set(ctx, true)
if not matched then
return true
[apisix] 01/05: ci: make it pass under OpenResty 1.21 (#7067)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.13
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 748e8fe5a2dc9e9b7ae9303f0196b643ad1de02f
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Wed May 18 11:17:53 2022 +0800
ci: make it pass under OpenResty 1.21 (#7067)
Signed-off-by: spacewander <sp...@gmail.com>
---
bin/apisix | 10 +++++-----
utils/linux-install-luarocks.sh | 4 ++--
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/bin/apisix b/bin/apisix
index d83b0ce4b..d1b17f5a2 100755
--- a/bin/apisix
+++ b/bin/apisix
@@ -31,11 +31,11 @@ fi
# find the openresty
OR_BIN=$(which openresty || exit 1)
OR_EXEC=${OR_BIN:-'/usr/local/openresty-debug/bin/openresty'}
-OR_VER=$(openresty -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1"."$2}')
+OR_VER=$(openresty -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1 * 100 + $2}')
LUA_VERSION=$(lua -v 2>&1| grep -E -o "Lua [0-9]+.[0-9]+")
-if [[ -e $OR_EXEC && "$OR_VER" =~ "1.19" ]]; then
- # OpenResty version is 1.19, use luajit by default
+if [[ -e $OR_EXEC && "$OR_VER" -ge 119 ]]; then
+ # OpenResty version is >= 1.19, use luajit by default
# find the luajit binary of openresty
LUAJIT_BIN=$(${OR_EXEC} -V 2>&1 | grep prefix | grep -Eo 'prefix=(.*)/nginx\s+--' | grep -Eo '/.*/')luajit/bin/luajit
@@ -43,9 +43,9 @@ if [[ -e $OR_EXEC && "$OR_VER" =~ "1.19" ]]; then
echo "$LUAJIT_BIN $APISIX_LUA $*"
exec $LUAJIT_BIN $APISIX_LUA $*
elif [[ "$LUA_VERSION" =~ "Lua 5.1" ]]; then
- # OpenResty version is not 1.19, use Lua 5.1 by default
+ # OpenResty version is < 1.19, use Lua 5.1 by default
echo "lua $APISIX_LUA $*"
exec lua $APISIX_LUA $*
else
- echo "ERROR: Please check the version of OpenResty and Lua, OpenResty 1.19 + LuaJIT or OpenResty before 1.19 + Lua 5.1 is required for Apache APISIX."
+ echo "ERROR: Please check the version of OpenResty and Lua, OpenResty 1.19+ + LuaJIT or OpenResty before 1.19 + Lua 5.1 is required for Apache APISIX."
fi
diff --git a/utils/linux-install-luarocks.sh b/utils/linux-install-luarocks.sh
index be738ce45..a8d1bafd0 100755
--- a/utils/linux-install-luarocks.sh
+++ b/utils/linux-install-luarocks.sh
@@ -29,8 +29,8 @@ rm -f v"$LUAROCKS_VER".tar.gz
cd luarocks-"$LUAROCKS_VER" || exit
OR_BIN="$OPENRESTY_PREFIX/bin/openresty"
-OR_VER=$($OR_BIN -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1"."$2}')
-if [[ -e $OR_BIN && "$OR_VER" == 1.19 ]]; then
+OR_VER=$($OR_BIN -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1 * 100 + $2}')
+if [[ -e $OR_BIN && "$OR_VER" -ge 119 ]]; then
WITH_LUA_OPT="--with-lua=${OPENRESTY_PREFIX}/luajit"
else
# For old version OpenResty, we still need to install LuaRocks with Lua
[apisix] 02/05: ci(traffic-split): improve ci stability (#7055)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.13
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 0c73489e7a7ed23cfd4ae9fdda678ca8c4bb0a11
Author: soulbird <zh...@outlook.com>
AuthorDate: Mon May 16 14:24:27 2022 +0800
ci(traffic-split): improve ci stability (#7055)
Co-authored-by: soulbird <zh...@gmail.com>
---
t/plugin/traffic-split.t | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/t/plugin/traffic-split.t b/t/plugin/traffic-split.t
index ea11f85e3..7f1afd5dd 100644
--- a/t/plugin/traffic-split.t
+++ b/t/plugin/traffic-split.t
@@ -696,7 +696,7 @@ GET /t
local json = require("toolkit.json")
local t = require("lib.test_admin").test
local data = {
- uri = "/server_port",
+ uri = "/",
plugins = {
["traffic-split"] = {
rules = { {
@@ -704,8 +704,10 @@ GET /t
upstream = {
name = "upstream_A",
type = "roundrobin",
+ pass_host = "rewrite",
+ upstream_host = "www.apiseven.com",
nodes = {
- ["apiseven.com:80"] = 0
+ ["www.apiseven.com:80"] = 0
}
},
weight = 100000
@@ -743,10 +745,10 @@ passed
=== TEST 19: domain name resolved successfully
--- request
-GET /server_port
---- error_code: 502
+GET /
+--- error_code: 200
--- error_log eval
-qr/dns resolver domain: apiseven.com to \d+.\d+.\d+.\d+/
+qr/dns resolver domain: www.apiseven.com to \d+.\d+.\d+.\d+/
[apisix] 03/05: fix: the client verify flag might not be set (#6906)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.13
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 80b6b2d213d5f6e09e3fb3387f150d4e9bc58d2b
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Fri Apr 22 19:35:20 2022 +0800
fix: the client verify flag might not be set (#6906)
A more suitable way is to reject the client TLS handshake directly, just
like what Go has done.
Fix #6896
Signed-off-by: spacewander <sp...@gmail.com>
---
apisix/init.lua | 25 ++++++++++++++++---------
apisix/ssl/router/radixtree_sni.lua | 8 +++++---
2 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/apisix/init.lua b/apisix/init.lua
index f826a366f..4717646de 100644
--- a/apisix/init.lua
+++ b/apisix/init.lua
@@ -36,6 +36,7 @@ local get_var = require("resty.ngxvar").fetch
local router = require("apisix.router")
local apisix_upstream = require("apisix.upstream")
local set_upstream = apisix_upstream.set_by_route
+local apisix_ssl = require("apisix.ssl")
local upstream_util = require("apisix.utils.upstream")
local ctxdump = require("resty.ctxdump")
local ipmatcher = require("resty.ipmatcher")
@@ -309,7 +310,13 @@ end
local function verify_tls_client(ctx)
- if ctx and ctx.ssl_client_verified then
+ local matched = router.router_ssl.match_and_set(ctx, true)
+ if not matched then
+ return true
+ end
+
+ local matched_ssl = ctx.matched_ssl
+ if matched_ssl.value.client and apisix_ssl.support_client_verification() then
local res = ngx_var.ssl_client_verify
if res ~= "SUCCESS" then
if res == "NONE" then
@@ -346,14 +353,14 @@ end
function _M.http_access_phase()
local ngx_ctx = ngx.ctx
- if not verify_tls_client(ngx_ctx.api_ctx) then
- return core.response.exit(400)
- end
-
-- always fetch table from the table pool, we don't need a reused api_ctx
local api_ctx = core.tablepool.fetch("api_ctx", 0, 32)
ngx_ctx.api_ctx = api_ctx
+ if not verify_tls_client(api_ctx) then
+ return core.response.exit(400)
+ end
+
core.ctx.set_vars_meta(api_ctx)
debug.dynamic_debug(api_ctx)
@@ -863,15 +870,15 @@ function _M.stream_preread_phase()
local ngx_ctx = ngx.ctx
local api_ctx = ngx_ctx.api_ctx
- if not verify_tls_client(ngx_ctx.api_ctx) then
- return ngx_exit(1)
- end
-
if not api_ctx then
api_ctx = core.tablepool.fetch("api_ctx", 0, 32)
ngx_ctx.api_ctx = api_ctx
end
+ if not verify_tls_client(api_ctx) then
+ return ngx_exit(1)
+ end
+
core.ctx.set_vars_meta(api_ctx)
local ok, err = router.router_stream.match(api_ctx)
diff --git a/apisix/ssl/router/radixtree_sni.lua b/apisix/ssl/router/radixtree_sni.lua
index 1b3220cd1..70ac0faa3 100644
--- a/apisix/ssl/router/radixtree_sni.lua
+++ b/apisix/ssl/router/radixtree_sni.lua
@@ -117,7 +117,7 @@ local function set_pem_ssl_key(sni, cert, pkey)
end
-function _M.match_and_set(api_ctx)
+function _M.match_and_set(api_ctx, match_only)
local err
if not radixtree_router or
radixtree_router_ver ~= ssl_certificates.conf_version then
@@ -175,6 +175,10 @@ function _M.match_and_set(api_ctx)
local matched_ssl = api_ctx.matched_ssl
core.log.info("debug - matched: ", core.json.delay_encode(matched_ssl, true))
+ if match_only then
+ return true
+ end
+
ngx_ssl.clear_certs()
ok, err = set_pem_ssl_key(sni, matched_ssl.value.cert,
@@ -209,8 +213,6 @@ function _M.match_and_set(api_ctx)
if not ok then
return false, err
end
-
- api_ctx.ssl_client_verified = true
end
end