You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@apisix.apache.org by "Revolyssup (via GitHub)" <gi...@apache.org> on 2025/10/13 19:47:16 UTC
[PR] feat: add support for wildcard on SNIs for SSL [apisix]
Revolyssup opened a new pull request, #12668:
URL: https://github.com/apache/apisix/pull/12668
The current APISIX SSL SNI only allows exact domain name matching "abc.api7.dev" and partial wildcard ".api7.dev". It does not support the complete wildcard value of "" for SNI, which does not meet the core consistency test requirements of HTTPSListener in the Gateway API. This situation needs to be supported.
### Checklist
- [ ] I have explained the need for this PR and the problem it solves
- [ ] I have explained the changes or the new features added to this PR
- [ ] I have added tests corresponding to this change
- [ ] I have updated the documentation to reflect this change
- [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first)
<!--
Note
1. Mark the PR as draft until it's ready to be reviewed.
2. Always add/update tests for any changes unless you have a good reason.
3. Always update the documentation to reflect the changes made in the PR.
4. Make a new commit to resolve conversations instead of `push -f`.
5. To resolve merge conflicts, merge master instead of rebasing.
6. Use "request review" to notify the reviewer after making changes.
7. Only a reviewer can mark a conversation as resolved.
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428086627
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
+ if not ok then
+ for _, ssl in config_util.iterate_values(ssl_certificates.values) do
+ if ssl.value and ssl.value.type == "server" and
+ (ssl.value.status == nil or ssl.value.status == 1) then
+ local has_wildcard = false
+ if ssl.value.sni == "*" then
+ has_wildcard = true
+ elseif type(ssl.value.snis) == "table" then
+ for _, s in ipairs(ssl.value.snis) do
+ if s == "*" then
+ has_wildcard = true
+ break
+ end
+ end
+ end
+ if has_wildcard then
+ api_ctx.matched_ssl = ssl
+ api_ctx.matched_sni = "*"
+ ok = true
+ break
+ end
+ end
+ end
+ end
Review Comment:
This is more complicated than I imagined, is it necessary? For [lua-resty-radixtree](https://github.com/api7/lua-resty-radixtree), what will be the behavior of a single wildcard when matching?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428094665
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
+ j = j + 1
+ sni[j] = s:reverse()
+ end
end
else
- sni = ssl.value.sni:reverse()
+ if ssl.value.sni ~= "*" then
+ sni = ssl.value.sni:reverse()
+ end
end
- idx = idx + 1
- route_items[idx] = {
- paths = sni,
- handler = function (api_ctx)
- if not api_ctx then
- return
+ if sni and (type(sni) == "table" and #sni > 0 or type(sni) == "string") then
+ idx = idx + 1
+ route_items[idx] = {
+ paths = sni,
+ handler = function (api_ctx)
+ if not api_ctx then
+ return
+ end
+ api_ctx.matched_ssl = ssl
+ api_ctx.matched_sni = sni
end
- api_ctx.matched_ssl = ssl
- api_ctx.matched_sni = sni
- end
- }
+ }
+ end
Review Comment:
What happened when we put `*` into radixtree? Doesn't it naturally serve as a catch-all matching case?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 merged PR #12668:
URL: https://github.com/apache/apisix/pull/12668
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "membphis (via GitHub)" <gi...@apache.org>.
membphis commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428103651
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
Review Comment:
to me, I think we can keep old code, it seems work fine too? all right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428488526
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
Review Comment:
Okay i was wrong. Due to an initial mistake in my code I got that failure and falsely assumed it was because radixtree couldn't handle it. I have modified the PR. Apologies for mistake
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428130574
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
+ j = j + 1
+ sni[j] = s:reverse()
+ end
end
else
- sni = ssl.value.sni:reverse()
+ if ssl.value.sni ~= "*" then
+ sni = ssl.value.sni:reverse()
+ end
Review Comment:
ditto
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
+ j = j + 1
+ sni[j] = s:reverse()
+ end
end
else
- sni = ssl.value.sni:reverse()
+ if ssl.value.sni ~= "*" then
+ sni = ssl.value.sni:reverse()
+ end
end
- idx = idx + 1
- route_items[idx] = {
- paths = sni,
- handler = function (api_ctx)
- if not api_ctx then
- return
+ if sni and (type(sni) == "table" and #sni > 0 or type(sni) == "string") then
Review Comment:
This seems to cover all existing scenarios. Is this necessary?
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
Review Comment:
Can't radix trees perform wildcard matching directly? Why do wildcard matches work fine in our HTTP routes (`/test/*`) and SSL SNI (`*.example.com`)?
In my view, there's no fundamental difference between `*.example.com` and `*`. If the former works correctly after reverse resolution, the latter should also function out of the box. We shouldn't need to add any special logic for this.
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
+ j = j + 1
+ sni[j] = s:reverse()
+ end
Review Comment:
<img width="327" height="53" alt="Image" src="https://github.com/user-attachments/assets/629e7741-aa9e-4143-ae7e-e2e49ae5485c" />
It is reasonable not to perform additional processing, as it does not cause any issues.
This is not necessary, as `("*"):reverse()` functions correctly. Even if this extra check were added, it would only apply in extremely rare cases and would require explanation for maintainability. I do not believe it differs from normal sni case.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428242289
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
Review Comment:
The main point of contention lies in https://github.com/apache/apisix/pull/12668#discussion_r2428142875, which determines whether we must handle the * case separately.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428180231
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
Review Comment:
I saw your reply at https://github.com/apache/apisix/pull/12668#discussion_r2428104868, but it doesn't resolve this concern. We should investigate the root cause.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on PR #12668:
URL: https://github.com/apache/apisix/pull/12668#issuecomment-3400375712
## Result with only the regex change
```bash
12:23:55.048914 [0-0] == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):
12:23:55.048962 [0-0] => Send SSL data, 1556 bytes (0x614)
0000: ......\F....#.J.-..Y....rW.E........P. [`..+.G.l-A...i.n..NR6...
0040: 9.)..MX.<.......,.0.........+./...$.(.k.#.'.g.....9.....3.....=.
0080: <.5./..................www.test.com.............................
00c0: ......h2.http/1.1.........1.....6.4.............................
0100: ........................+........-.....3.........G|.lT..M......y
0140: ..|..3z7.#...:_.h.U..4.........F..fS.7..uZ'1..B...G.8.6.vS^;...1
0180: p..[.FG.SK....2..'.;...q......YKEx...Yg@c....Ho..C..oF..k....D..
01c0: o.*.........wQ.$.dD.....S...,...c...a*z....ps..8.YU.9...$..uQ.Wv
0200: i"...*@...3.*I6..qs..'.......mH..X%....P..y'. j.D=F!..5.W.9/.!.`
0240: ....m.I}Q...%.....&v..gP.......xAm.\...c.h....u9g.w..cS..w/..-..
0280: ...O.5.FZ.....I."bd.s=....{.".`Z..7D...H..R.....4 ....x*3.....G.
02c0: . ..=*....1..c......]..5A.....tN.x...>....Y..z..rF.....W..[N@...
0300: |?...P...c..=.H.:*....?..sCw.U.fX....3..?*0..J.k1:...6....W...T.
0340: ..P...5(..&.S.5.{.Fa...as*m...Y.......m...."g...{...c.3.....t.*.
0380: .+..1)".~....E..%.:..<....2...55.F4..W.X..b_:..C..SW\Tq_..]o..g)
03c0: ........7..7..Z.cb..WS...J.m.`.-....B.S...I..%.r.|.Y.g?.........
0400: .jB9...k..k%.U........9...Q..8.....7........0.....<,wB..Ivc-..<.
0440: .l.85...$.`c.;/.5Y..N..H..:..L......\..1.....Ux.DB...e#....c....
0480: ......lCb......TJ8^.b,l..mq.....w,....z5.........U.e..+v.%Q..[..
04c0: yBH$..e......p/.....+...t.}8A..k.....VK*;5.2...L..h...Q.S!.!{.S.
0500: Q$.q.......b3..x~39..Ht..L....z.7x..1L..(&..Q..e.BV......+F_.+..
0540: .8...@P..|..'...b.p...AJ\..zB.q.d<...?.+... ........q...)U....w<
0580: ....*.FRl..N..Zzlm3...pc.......,%..D....W.jS!.k.^d....V.....rZdN
05c0: <..ID.......`.....W0...k.~.....Mj...k.....R[zpP2... ..}8.V.<.{..
0600: .._3..6j4...{m. b...
12:23:55.050238 [0-0] == Info: [SSL] ossl_bio_cf_out_write(len=1561) -> 0, 1561
12:23:55.050293 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 81, 0
12:23:55.050336 [0-0] == Info: [SSL] ossl_populate_x509_store, path=/etc/ssl/certs/ca-certificates.crt, blob=0
12:23:55.050409 [0-0] == Info: [SSL] SSL_connect() -> err=-1, detail=2
12:23:55.050456 [0-0] == Info: [SSL] SSL_connect() -> want recv
12:23:55.050502 [0-0] == Info: [SSL] cf_connect() -> 0, done=0
12:23:55.050550 [0-0] == Info: [HTTPS-CONNECT] connect -> 0, done=0
12:23:55.050599 [0-0] == Info: [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
12:23:55.050659 [0-0] == Info: [SSL] adjust_pollset, POLLIN fd=5
12:23:55.050699 [0-0] == Info: [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
12:23:55.050752 [0-0] == Info: [SSL] cf_connect()
12:23:55.050788 [0-0] == Info: [SSL] ossl_connect, step2
12:23:55.050830 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 0, 5
12:23:55.050879 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: .....
12:23:55.050931 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=2) -> 0, 2
12:23:55.050979 [0-0] == Info: TLSv1.3 (IN), TLS alert, internal error (592):
12:23:55.051024 [0-0] <= Recv SSL data, 2 bytes (0x2)
0000: .P
12:23:55.051074 [0-0] == Info: [SSL] SSL_connect() -> err=-1, detail=1
12:23:55.051124 [0-0] == Info: TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error
12:23:55.051207 [0-0] == Info: [SSL] cf_connect() -> 35, done=0
12:23:55.051251 [0-0] == Info: [HTTPS-CONNECT] connect, all attempts failed
12:23:55.051302 [0-0] == Info: [HTTPS-CONNECT] connect -> 35, done=0
12:23:55.051351 [0-0] == Info: [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 35, done=0
12:23:55.051420 [0-0] == Info: [HTTPS-CONNECT] Curl_conn_connect(), filter returned 35
12:23:55.051478 [0-0] == Info: [WRITE] [OUT] done
12:23:55.051513 [0-0] == Info: closing connection #0
curl: (35) TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error
```
## With the above code change it successfully completed handshake
```bash
0000:
12:25:28.727163 [0-0] == Info: [WRITE] header_collect pushed(type=1, len=2) -> 0
12:25:28.727218 [0-0] == Info: [WRITE] [OUT] wrote 2 header bytes -> 2
12:25:28.727262 [0-0] == Info: [WRITE] [PAUSE] writing 2/2 bytes of type 4 -> 0
12:25:28.727312 [0-0] == Info: [WRITE] download_write header(type=4, blen=2) -> 0
12:25:28.727367 [0-0] == Info: [WRITE] client_write(type=4, len=2) -> 0
12:25:28.727419 [0-0] <= Recv data, 309 bytes (0x135)
0000: {. "args": {}, . "headers": {. "Accept": "*/*", . "Host"
0040: : "www.test.com", . "User-Agent": "curl/8.16.0", . "X-Amzn
0080: -Trace-Id": "Root=1-68edf3e0-3e4b97345b596c214d24168a", . "X-
00c0: Forwarded-Host": "www.test.com". }, . "origin": "127.0.0.1, 12
0100: 2.177.98.216", . "url": "http://www.test.com/get".}.
{
"args": {},
"headers": {
"Accept": "*/*",
"Host": "www.test.com",
"User-Agent": "curl/8.16.0",
"X-Amzn-Trace-Id": "Root=1-68edf3e0-3e4b97345b596c214d24168a",
"X-Forwarded-Host": "www.test.com"
},
"origin": "127.0.0.1, 122.177.98.216",
"url": "http://www.test.com/get"
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428104868
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -55,24 +55,30 @@ local function create_router(ssl_items)
if type(ssl.value.snis) == "table" and #ssl.value.snis > 0 then
sni = core.table.new(0, #ssl.value.snis)
for _, s in ipairs(ssl.value.snis) do
- j = j + 1
- sni[j] = s:reverse()
+ if s ~= "*" then
+ j = j + 1
+ sni[j] = s:reverse()
+ end
end
else
- sni = ssl.value.sni:reverse()
+ if ssl.value.sni ~= "*" then
+ sni = ssl.value.sni:reverse()
+ end
end
- idx = idx + 1
- route_items[idx] = {
- paths = sni,
- handler = function (api_ctx)
- if not api_ctx then
- return
+ if sni and (type(sni) == "table" and #sni > 0 or type(sni) == "string") then
+ idx = idx + 1
+ route_items[idx] = {
+ paths = sni,
+ handler = function (api_ctx)
+ if not api_ctx then
+ return
+ end
+ api_ctx.matched_ssl = ssl
+ api_ctx.matched_sni = sni
end
- api_ctx.matched_ssl = ssl
- api_ctx.matched_sni = sni
- end
- }
+ }
+ end
Review Comment:
## Result with only the regex change
```bash
12:23:55.048914 [0-0] == Info: TLSv1.3 (OUT), TLS handshake, Client hello (1):
12:23:55.048962 [0-0] => Send SSL data, 1556 bytes (0x614)
0000: ......\F....#.J.-..Y....rW.E........P. [`..+.G.l-A...i.n..NR6...
0040: 9.)..MX.<.......,.0.........+./...$.(.k.#.'.g.....9.....3.....=.
0080: <.5./..................www.test.com.............................
00c0: ......h2.http/1.1.........1.....6.4.............................
0100: ........................+........-.....3.........G|.lT..M......y
0140: ..|..3z7.#...:_.h.U..4.........F..fS.7..uZ'1..B...G.8.6.vS^;...1
0180: p..[.FG.SK....2..'.;...q......YKEx...Yg@c....Ho..C..oF..k....D..
01c0: o.*.........wQ.$.dD.....S...,...c...a*z....ps..8.YU.9...$..uQ.Wv
0200: i"...*@...3.*I6..qs..'.......mH..X%....P..y'. j.D=F!..5.W.9/.!.`
0240: ....m.I}Q...%.....&v..gP.......xAm.\...c.h....u9g.w..cS..w/..-..
0280: ...O.5.FZ.....I."bd.s=....{.".`Z..7D...H..R.....4 ....x*3.....G.
02c0: . ..=*....1..c......]..5A.....tN.x...>....Y..z..rF.....W..[N@...
0300: |?...P...c..=.H.:*....?..sCw.U.fX....3..?*0..J.k1:...6....W...T.
0340: ..P...5(..&.S.5.{.Fa...as*m...Y.......m...."g...{...c.3.....t.*.
0380: .+..1)".~....E..%.:..<....2...55.F4..W.X..b_:..C..SW\Tq_..]o..g)
03c0: ........7..7..Z.cb..WS...J.m.`.-....B.S...I..%.r.|.Y.g?.........
0400: .jB9...k..k%.U........9...Q..8.....7........0.....<,wB..Ivc-..<.
0440: .l.85...$.`c.;/.5Y..N..H..:..L......\..1.....Ux.DB...e#....c....
0480: ......lCb......TJ8^.b,l..mq.....w,....z5.........U.e..+v.%Q..[..
04c0: yBH$..e......p/.....+...t.}8A..k.....VK*;5.2...L..h...Q.S!.!{.S.
0500: Q$.q.......b3..x~39..Ht..L....z.7x..1L..(&..Q..e.BV......+F_.+..
0540: .8...@P..|..'...b.p...AJ\..zB.q.d<...?.+... ........q...)U....w<
0580: ....*.FRl..N..Zzlm3...pc.......,%..D....W.jS!.k.^d....V.....rZdN
05c0: <..ID.......`.....W0...k.~.....Mj...k.....R[zpP2... ..}8.V.<.{..
0600: .._3..6j4...{m. b...
12:23:55.050238 [0-0] == Info: [SSL] ossl_bio_cf_out_write(len=1561) -> 0, 1561
12:23:55.050293 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 81, 0
12:23:55.050336 [0-0] == Info: [SSL] ossl_populate_x509_store, path=/etc/ssl/certs/ca-certificates.crt, blob=0
12:23:55.050409 [0-0] == Info: [SSL] SSL_connect() -> err=-1, detail=2
12:23:55.050456 [0-0] == Info: [SSL] SSL_connect() -> want recv
12:23:55.050502 [0-0] == Info: [SSL] cf_connect() -> 0, done=0
12:23:55.050550 [0-0] == Info: [HTTPS-CONNECT] connect -> 0, done=0
12:23:55.050599 [0-0] == Info: [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 0, done=0
12:23:55.050659 [0-0] == Info: [SSL] adjust_pollset, POLLIN fd=5
12:23:55.050699 [0-0] == Info: [HTTPS-CONNECT] adjust_pollset -> 0, 1 socks
12:23:55.050752 [0-0] == Info: [SSL] cf_connect()
12:23:55.050788 [0-0] == Info: [SSL] ossl_connect, step2
12:23:55.050830 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=5) -> 0, 5
12:23:55.050879 [0-0] <= Recv SSL data, 5 bytes (0x5)
0000: .....
12:23:55.050931 [0-0] == Info: [SSL] ossl_bio_cf_in_read(len=2) -> 0, 2
12:23:55.050979 [0-0] == Info: TLSv1.3 (IN), TLS alert, internal error (592):
12:23:55.051024 [0-0] <= Recv SSL data, 2 bytes (0x2)
0000: .P
12:23:55.051074 [0-0] == Info: [SSL] SSL_connect() -> err=-1, detail=1
12:23:55.051124 [0-0] == Info: TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error
12:23:55.051207 [0-0] == Info: [SSL] cf_connect() -> 35, done=0
12:23:55.051251 [0-0] == Info: [HTTPS-CONNECT] connect, all attempts failed
12:23:55.051302 [0-0] == Info: [HTTPS-CONNECT] connect -> 35, done=0
12:23:55.051351 [0-0] == Info: [HTTPS-CONNECT] Curl_conn_connect(block=0) -> 35, done=0
12:23:55.051420 [0-0] == Info: [HTTPS-CONNECT] Curl_conn_connect(), filter returned 35
12:23:55.051478 [0-0] == Info: [WRITE] [OUT] done
12:23:55.051513 [0-0] == Info: closing connection #0
curl: (35) TLS connect error: error:0A000438:SSL routines::tlsv1 alert internal error
```
## With the above code change it successfully completed handshake
```bash
0000:
12:25:28.727163 [0-0] == Info: [WRITE] header_collect pushed(type=1, len=2) -> 0
12:25:28.727218 [0-0] == Info: [WRITE] [OUT] wrote 2 header bytes -> 2
12:25:28.727262 [0-0] == Info: [WRITE] [PAUSE] writing 2/2 bytes of type 4 -> 0
12:25:28.727312 [0-0] == Info: [WRITE] download_write header(type=4, blen=2) -> 0
12:25:28.727367 [0-0] == Info: [WRITE] client_write(type=4, len=2) -> 0
12:25:28.727419 [0-0] <= Recv data, 309 bytes (0x135)
0000: {. "args": {}, . "headers": {. "Accept": "*/*", . "Host"
0040: : "www.test.com", . "User-Agent": "curl/8.16.0", . "X-Amzn
0080: -Trace-Id": "Root=1-68edf3e0-3e4b97345b596c214d24168a", . "X-
00c0: Forwarded-Host": "www.test.com". }, . "origin": "127.0.0.1, 12
0100: 2.177.98.216", . "url": "http://www.test.com/get".}.
{
"args": {},
"headers": {
"Accept": "*/*",
"Host": "www.test.com",
"User-Agent": "curl/8.16.0",
"X-Amzn-Trace-Id": "Root=1-68edf3e0-3e4b97345b596c214d24168a",
"X-Forwarded-Host": "www.test.com"
},
"origin": "127.0.0.1, 122.177.98.216",
"url": "http://www.test.com/get"
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "Revolyssup (via GitHub)" <gi...@apache.org>.
Revolyssup commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428179262
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
Review Comment:
Please refer https://github.com/apache/apisix/pull/12668#discussion_r2428104868
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "nic-6443 (via GitHub)" <gi...@apache.org>.
nic-6443 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428086627
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
+ if not ok then
+ for _, ssl in config_util.iterate_values(ssl_certificates.values) do
+ if ssl.value and ssl.value.type == "server" and
+ (ssl.value.status == nil or ssl.value.status == 1) then
+ local has_wildcard = false
+ if ssl.value.sni == "*" then
+ has_wildcard = true
+ elseif type(ssl.value.snis) == "table" then
+ for _, s in ipairs(ssl.value.snis) do
+ if s == "*" then
+ has_wildcard = true
+ break
+ end
+ end
+ end
+ if has_wildcard then
+ api_ctx.matched_ssl = ssl
+ api_ctx.matched_sni = "*"
+ ok = true
+ break
+ end
+ end
+ end
+ end
Review Comment:
This is more complicated than I imagined, is it necessary? For [lua-resty-radixtree](https://github.com/api7/lua-resty-radixtree), what will be the behavior of a single wildcard when matching?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428142875
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
Review Comment:
Can't radix trees perform wildcard matching directly? Why do wildcard matches work fine in our HTTP routes (`/test/*`) and SSL SNI (`*.example.com`)?
In my view, there's no fundamental difference between `*.example.com` and `*`. If the former works correctly after reverse sort, the latter should also function out of the box. We shouldn't need to add any special logic for this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat: add support for wildcard on SNIs for SSL [apisix]
Posted by "bzp2010 (via GitHub)" <gi...@apache.org>.
bzp2010 commented on code in PR #12668:
URL: https://github.com/apache/apisix/pull/12668#discussion_r2428180231
##########
apisix/ssl/router/radixtree_sni.lua:
##########
@@ -171,6 +176,33 @@ function _M.match_and_set(api_ctx, match_only, alt_sni)
local sni_rev = sni:reverse()
local ok = radixtree_router:dispatch(sni_rev, nil, api_ctx)
+
+ -- if no SSL matched, try to find a wildcard SSL
Review Comment:
I saw your reply at https://github.com/apache/apisix/pull/12668#discussion_r2428104868, but it doesn't resolve this consideration. We should investigate the root cause.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@apisix.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org