You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by sp...@apache.org on 2022/05/20 07:22:17 UTC
[apisix] branch release/2.10 updated (6c7d1620a -> 31dc18627)
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a change to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
from 6c7d1620a fix(jwt-auth): avoid leak secret via the error msg (#6855)
new 7d446aa5c test: reject bad client TLS request in handshake (#6941)
new 5a4a5bfff perf: avoid rematching SSL when our customized Nginx is used (#6970)
new c2eff65dc fix: the client verify flag might not be set (#6906)
new 2b7fe2313 ci(traffic-split): improve ci stability (#7055)
new 0a14a1d8e ci: make it pass under OpenResty 1.21 (#7067)
new 19d1cba1d use the latest build script for apisix-base
new 31dc18627 build apisix-base with the master branch code of apisix-build-tools
The 7 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
apisix/init.lua | 36 +++++++++++++++++++++++++++---------
apisix/ssl/router/radixtree_sni.lua | 8 +++++---
bin/apisix | 10 +++++-----
t/node/client-mtls.t | 8 ++++----
t/plugin/traffic-split.t | 12 +++++++-----
utils/linux-install-luarocks.sh | 4 ++--
utils/linux-install-openresty.sh | 6 +++---
7 files changed, 53 insertions(+), 31 deletions(-)
[apisix] 02/07: perf: avoid rematching SSL when our customized Nginx is used (#6970)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 5a4a5bfff206507ad5ba6557699b16e57c3bd742
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Thu May 5 14:12:26 2022 +0800
perf: avoid rematching SSL when our customized Nginx is used (#6970)
Signed-off-by: spacewander <sp...@gmail.com>
---
apisix/init.lua | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/apisix/init.lua b/apisix/init.lua
index a4a0fdd11..06daccab2 100644
--- a/apisix/init.lua
+++ b/apisix/init.lua
@@ -52,6 +52,11 @@ if ngx.config.subsystem == "http" then
control_api_router = require("apisix.control.router")
end
+local ok, apisix_base_flags = pcall(require, "resty.apisix.patch")
+if not ok then
+ apisix_base_flags = {}
+end
+
local load_balancer
local local_conf
local ver_header = "APISIX/" .. core.version.VERSION
@@ -309,6 +314,12 @@ end
local function verify_tls_client(ctx)
+ if apisix_base_flags.client_cert_verified_in_handshake then
+ -- For apisix-base, there is no need to rematch SSL rules as the invalid
+ -- connections are already rejected in the handshake
+ return true
+ end
+
if ctx and ctx.ssl_client_verified then
local res = ngx_var.ssl_client_verify
if res ~= "SUCCESS" then
[apisix] 01/07: test: reject bad client TLS request in handshake (#6941)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 7d446aa5c7fcbe4f97c7b4c3fd388148efe265d3
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Wed Apr 27 11:25:34 2022 +0800
test: reject bad client TLS request in handshake (#6941)
---
t/node/client-mtls.t | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/t/node/client-mtls.t b/t/node/client-mtls.t
index c748935d3..afccc9375 100644
--- a/t/node/client-mtls.t
+++ b/t/node/client-mtls.t
@@ -244,9 +244,9 @@ GET /t
GET /mtls2
--- more_headers
Host: localhost
---- error_code: 400
+--- error_code: 502
--- error_log
-client certificate was not present
+peer did not return a certificate
@@ -301,6 +301,6 @@ GET /t
GET /mtls3
--- more_headers
Host: localhost
---- error_code: 400
+--- error_code: 502
--- error_log
-clent certificate verification is not passed: FAILED:self signed certificate
+certificate verify failed
[apisix] 05/07: ci: make it pass under OpenResty 1.21 (#7067)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 0a14a1d8e2f3f04e91cfe5be9e557e1efdc729f5
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Wed May 18 11:17:53 2022 +0800
ci: make it pass under OpenResty 1.21 (#7067)
Signed-off-by: spacewander <sp...@gmail.com>
---
bin/apisix | 10 +++++-----
utils/linux-install-luarocks.sh | 4 ++--
2 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/bin/apisix b/bin/apisix
index d83b0ce4b..d1b17f5a2 100755
--- a/bin/apisix
+++ b/bin/apisix
@@ -31,11 +31,11 @@ fi
# find the openresty
OR_BIN=$(which openresty || exit 1)
OR_EXEC=${OR_BIN:-'/usr/local/openresty-debug/bin/openresty'}
-OR_VER=$(openresty -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1"."$2}')
+OR_VER=$(openresty -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1 * 100 + $2}')
LUA_VERSION=$(lua -v 2>&1| grep -E -o "Lua [0-9]+.[0-9]+")
-if [[ -e $OR_EXEC && "$OR_VER" =~ "1.19" ]]; then
- # OpenResty version is 1.19, use luajit by default
+if [[ -e $OR_EXEC && "$OR_VER" -ge 119 ]]; then
+ # OpenResty version is >= 1.19, use luajit by default
# find the luajit binary of openresty
LUAJIT_BIN=$(${OR_EXEC} -V 2>&1 | grep prefix | grep -Eo 'prefix=(.*)/nginx\s+--' | grep -Eo '/.*/')luajit/bin/luajit
@@ -43,9 +43,9 @@ if [[ -e $OR_EXEC && "$OR_VER" =~ "1.19" ]]; then
echo "$LUAJIT_BIN $APISIX_LUA $*"
exec $LUAJIT_BIN $APISIX_LUA $*
elif [[ "$LUA_VERSION" =~ "Lua 5.1" ]]; then
- # OpenResty version is not 1.19, use Lua 5.1 by default
+ # OpenResty version is < 1.19, use Lua 5.1 by default
echo "lua $APISIX_LUA $*"
exec lua $APISIX_LUA $*
else
- echo "ERROR: Please check the version of OpenResty and Lua, OpenResty 1.19 + LuaJIT or OpenResty before 1.19 + Lua 5.1 is required for Apache APISIX."
+ echo "ERROR: Please check the version of OpenResty and Lua, OpenResty 1.19+ + LuaJIT or OpenResty before 1.19 + Lua 5.1 is required for Apache APISIX."
fi
diff --git a/utils/linux-install-luarocks.sh b/utils/linux-install-luarocks.sh
index 8b6aad2c3..db81e0439 100755
--- a/utils/linux-install-luarocks.sh
+++ b/utils/linux-install-luarocks.sh
@@ -29,8 +29,8 @@ rm -f v"$LUAROCKS_VER".tar.gz
cd luarocks-"$LUAROCKS_VER" || exit
OR_BIN="$OPENRESTY_PREFIX/bin/openresty"
-OR_VER=$($OR_BIN -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1"."$2}')
-if [[ -e $OR_BIN && "$OR_VER" == 1.19 ]]; then
+OR_VER=$($OR_BIN -v 2>&1 | awk -F '/' '{print $2}' | awk -F '.' '{print $1 * 100 + $2}')
+if [[ -e $OR_BIN && "$OR_VER" -ge 119 ]]; then
WITH_LUA_OPT="--with-lua=${OPENRESTY_PREFIX}/luajit"
else
# For old version OpenResty, we still need to install LuaRocks with Lua
[apisix] 07/07: build apisix-base with the master branch code of apisix-build-tools
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 31dc1862769b01c0c8a5f17bc6121f6485227e0b
Author: tzssangglass <tz...@gmail.com>
AuthorDate: Fri May 20 13:30:36 2022 +0800
build apisix-base with the master branch code of apisix-build-tools
---
utils/linux-install-openresty.sh | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/utils/linux-install-openresty.sh b/utils/linux-install-openresty.sh
index 07038b504..c22899ed0 100755
--- a/utils/linux-install-openresty.sh
+++ b/utils/linux-install-openresty.sh
@@ -26,7 +26,7 @@ sudo apt-get update
if [ "$OPENRESTY_VERSION" == "source" ]; then
cd ..
- wget https://raw.githubusercontent.com/api7/apisix-build-tools/v2.7.0/build-apisix-base.sh
+ wget https://raw.githubusercontent.com/api7/apisix-build-tools/master/build-apisix-base.sh
chmod +x build-apisix-base.sh
./build-apisix-base.sh latest
[apisix] 04/07: ci(traffic-split): improve ci stability (#7055)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 2b7fe2313daadb0f5a0e2cbb2f556f1d16807fdd
Author: soulbird <zh...@outlook.com>
AuthorDate: Mon May 16 14:24:27 2022 +0800
ci(traffic-split): improve ci stability (#7055)
Co-authored-by: soulbird <zh...@gmail.com>
---
t/plugin/traffic-split.t | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/t/plugin/traffic-split.t b/t/plugin/traffic-split.t
index 423816f1f..d738edfe7 100644
--- a/t/plugin/traffic-split.t
+++ b/t/plugin/traffic-split.t
@@ -617,7 +617,7 @@ GET /t
local json = require("toolkit.json")
local t = require("lib.test_admin").test
local data = {
- uri = "/server_port",
+ uri = "/",
plugins = {
["traffic-split"] = {
rules = { {
@@ -625,8 +625,10 @@ GET /t
upstream = {
name = "upstream_A",
type = "roundrobin",
+ pass_host = "rewrite",
+ upstream_host = "www.apiseven.com",
nodes = {
- ["apiseven.com:80"] = 0
+ ["www.apiseven.com:80"] = 0
}
},
weight = 100000
@@ -664,10 +666,10 @@ passed
=== TEST 19: domain name resolved successfully
--- request
-GET /server_port
---- error_code: 502
+GET /
+--- error_code: 200
--- error_log eval
-qr/dns resolver domain: apiseven.com to \d+.\d+.\d+.\d+/
+qr/dns resolver domain: www.apiseven.com to \d+.\d+.\d+.\d+/
[apisix] 03/07: fix: the client verify flag might not be set (#6906)
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit c2eff65dca402ec2e6502be3daef1c9eac52f9af
Author: 罗泽轩 <sp...@gmail.com>
AuthorDate: Fri Apr 22 19:35:20 2022 +0800
fix: the client verify flag might not be set (#6906)
A more suitable way is to reject the client TLS handshake directly, just
like what Go has done.
Fix #6896
Signed-off-by: spacewander <sp...@gmail.com>
---
apisix/init.lua | 25 ++++++++++++++++---------
apisix/ssl/router/radixtree_sni.lua | 8 +++++---
2 files changed, 21 insertions(+), 12 deletions(-)
diff --git a/apisix/init.lua b/apisix/init.lua
index 06daccab2..eb6ebf0a6 100644
--- a/apisix/init.lua
+++ b/apisix/init.lua
@@ -26,6 +26,7 @@ local get_var = require("resty.ngxvar").fetch
local router = require("apisix.router")
local apisix_upstream = require("apisix.upstream")
local set_upstream = apisix_upstream.set_by_route
+local apisix_ssl = require("apisix.ssl")
local upstream_util = require("apisix.utils.upstream")
local ctxdump = require("resty.ctxdump")
local ipmatcher = require("resty.ipmatcher")
@@ -320,7 +321,13 @@ local function verify_tls_client(ctx)
return true
end
- if ctx and ctx.ssl_client_verified then
+ local matched = router.router_ssl.match_and_set(ctx, true)
+ if not matched then
+ return true
+ end
+
+ local matched_ssl = ctx.matched_ssl
+ if matched_ssl.value.client and apisix_ssl.support_client_verification() then
local res = ngx_var.ssl_client_verify
if res ~= "SUCCESS" then
if res == "NONE" then
@@ -357,14 +364,14 @@ end
function _M.http_access_phase()
local ngx_ctx = ngx.ctx
- if not verify_tls_client(ngx_ctx.api_ctx) then
- return core.response.exit(400)
- end
-
-- always fetch table from the table pool, we don't need a reused api_ctx
local api_ctx = core.tablepool.fetch("api_ctx", 0, 32)
ngx_ctx.api_ctx = api_ctx
+ if not verify_tls_client(api_ctx) then
+ return core.response.exit(400)
+ end
+
core.ctx.set_vars_meta(api_ctx)
debug.dynamic_debug(api_ctx)
@@ -881,15 +888,15 @@ function _M.stream_preread_phase()
local ngx_ctx = ngx.ctx
local api_ctx = ngx_ctx.api_ctx
- if not verify_tls_client(ngx_ctx.api_ctx) then
- return ngx_exit(1)
- end
-
if not api_ctx then
api_ctx = core.tablepool.fetch("api_ctx", 0, 32)
ngx_ctx.api_ctx = api_ctx
end
+ if not verify_tls_client(api_ctx) then
+ return ngx_exit(1)
+ end
+
core.ctx.set_vars_meta(api_ctx)
local ok, err = router.router_stream.match(api_ctx)
diff --git a/apisix/ssl/router/radixtree_sni.lua b/apisix/ssl/router/radixtree_sni.lua
index 433ed2de0..176559325 100644
--- a/apisix/ssl/router/radixtree_sni.lua
+++ b/apisix/ssl/router/radixtree_sni.lua
@@ -117,7 +117,7 @@ local function set_pem_ssl_key(sni, cert, pkey)
end
-function _M.match_and_set(api_ctx)
+function _M.match_and_set(api_ctx, match_only)
local err
if not radixtree_router or
radixtree_router_ver ~= ssl_certificates.conf_version then
@@ -175,6 +175,10 @@ function _M.match_and_set(api_ctx)
local matched_ssl = api_ctx.matched_ssl
core.log.info("debug - matched: ", core.json.delay_encode(matched_ssl, true))
+ if match_only then
+ return true
+ end
+
ngx_ssl.clear_certs()
ok, err = set_pem_ssl_key(sni, matched_ssl.value.cert,
@@ -209,8 +213,6 @@ function _M.match_and_set(api_ctx)
if not ok then
return false, err
end
-
- api_ctx.ssl_client_verified = true
end
end
[apisix] 06/07: use the latest build script for apisix-base
Posted by sp...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
spacewander pushed a commit to branch release/2.10
in repository https://gitbox.apache.org/repos/asf/apisix.git
commit 19d1cba1dceaece31d054002d6be648ee6ac3961
Author: tzssangglass <tz...@gmail.com>
AuthorDate: Fri May 20 13:26:09 2022 +0800
use the latest build script for apisix-base
---
utils/linux-install-openresty.sh | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/utils/linux-install-openresty.sh b/utils/linux-install-openresty.sh
index 57b6c5136..07038b504 100755
--- a/utils/linux-install-openresty.sh
+++ b/utils/linux-install-openresty.sh
@@ -26,9 +26,9 @@ sudo apt-get update
if [ "$OPENRESTY_VERSION" == "source" ]; then
cd ..
- wget https://raw.githubusercontent.com/api7/apisix-build-tools/v2.2.1/build-apisix-openresty.sh
- chmod +x build-apisix-openresty.sh
- ./build-apisix-openresty.sh latest
+ wget https://raw.githubusercontent.com/api7/apisix-build-tools/v2.7.0/build-apisix-base.sh
+ chmod +x build-apisix-base.sh
+ ./build-apisix-base.sh latest
sudo apt-get install openresty-openssl111-debug-dev
exit 0