Skip to content

Commit cc58476

Browse files
dongbeioubadongbeiouba
committed
Bugfix: fix NTLS cert check, move sign/enc certficate to upstream
Update to nginx 1.22.1 (#1719) add reject_handshake, but not fully consider the NTLS. That's okay if no ssl_certificate is configured but ssl_sign_certificate and ssl_enc_certificate are configured when NTLS is enabled. Move sign_certificate, enc_certificate to upstream to adapt to nginx 1.22.1. Add test-nginx-ntls CI.
1 parent ced71fc commit cc58476

File tree

8 files changed

+182
-94
lines changed

8 files changed

+182
-94
lines changed

‎.github/workflows/test-nginx-ntls.yml‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
name: test nginx ntls
2+
3+
on:
4+
push:
5+
branches: [ master ]
6+
pull_request:
7+
branches: [ master ]
8+
9+
jobs:
10+
build-and-test:
11+
runs-on: "ubuntu-20.04"
12+
strategy:
13+
fail-fast: false
14+
matrix:
15+
compiler:
16+
- { compiler: GNU, CC: gcc, CXX: g++}
17+
- { compiler: LLVM, CC: clang, CXX: clang++}
18+
steps:
19+
- uses: actions/checkout@v3
20+
with:
21+
path: tengine
22+
- name: checkout Tongsuo
23+
uses: actions/checkout@v3
24+
with:
25+
repository: Tongsuo-Project/Tongsuo
26+
path: Tongsuo
27+
- name: build Tongsuo
28+
working-directory: Tongsuo
29+
env:
30+
CC: ${{ matrix.compiler.CC }}
31+
run: |
32+
./config --prefix=${RUNNER_TEMP}/tongsuo enable-ntls no-shared
33+
make -s -j4
34+
make install_sw
35+
- name: build Tengine
36+
working-directory: tengine
37+
env:
38+
CC: ${{ matrix.compiler.CC }}
39+
CXX: ${{ matrix.compiler.CXX }}
40+
run: |
41+
./configure \
42+
--add-module=modules/ngx_openssl_ntls \
43+
--with-openssl=../Tongsuo \
44+
--with-openssl-opt="--api=1.1.1 enable-ntls" \
45+
--with-http_ssl_module \
46+
--with-stream \
47+
--with-stream_ssl_module \
48+
--with-stream_sni
49+
make -j2
50+
sudo make install
51+
- name: run test cases
52+
working-directory: tengine
53+
env:
54+
TEST_OPENSSL_BINARY: ${{ runner.temp }}/tongsuo/bin/tongsuo
55+
TEST_NGINX_BINARY: /usr/local/nginx/sbin/nginx
56+
TEST_NGINX_UNSAFE: yes
57+
run: |
58+
prove -Itests/nginx-tests/nginx-tests/lib/ modules/ngx_openssl_ntls/t

‎modules/ngx_openssl_ntls/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -114,4 +114,4 @@ prove -Itests/nginx-tests/nginx-tests/lib/ modules/ngx_openssl_ntls/t -v
114114

115115
## Reference
116116
- [Tongsuo website](https://www.tongsuo.net/)
117-
- [Tongsuo document](https://tongsuo.readthedocs.io/)
117+
- [Tongsuo document](https://www.yuque.com/tsdoc)

‎src/http/modules/ngx_http_grpc_module.c‎

Lines changed: 16 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -38,13 +38,6 @@ typedef struct {
3838
ngx_str_t ssl_trusted_certificate;
3939
ngx_str_t ssl_crl;
4040
ngx_array_t *ssl_conf_commands;
41-
42-
#if (T_NGX_SSL_NTLS)
43-
ngx_str_t enc_certificate;
44-
ngx_str_t enc_certificate_key;
45-
ngx_str_t sign_certificate;
46-
ngx_str_t sign_certificate_key;
47-
#endif
4841
#endif
4942
} ngx_http_grpc_loc_conf_t;
5043

@@ -468,28 +461,28 @@ static ngx_command_t ngx_http_grpc_commands[] = {
468461
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
469462
ngx_conf_set_str_slot,
470463
NGX_HTTP_LOC_CONF_OFFSET,
471-
offsetof(ngx_http_grpc_loc_conf_t, enc_certificate),
464+
offsetof(ngx_http_grpc_loc_conf_t, upstream.enc_certificate),
472465
NULL },
473466

474467
{ ngx_string("grpc_ssl_enc_certificate_key"),
475468
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
476469
ngx_conf_set_str_slot,
477470
NGX_HTTP_LOC_CONF_OFFSET,
478-
offsetof(ngx_http_grpc_loc_conf_t, enc_certificate_key),
471+
offsetof(ngx_http_grpc_loc_conf_t, upstream.enc_certificate_key),
479472
NULL },
480473

481474
{ ngx_string("grpc_ssl_sign_certificate"),
482475
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
483476
ngx_conf_set_str_slot,
484477
NGX_HTTP_LOC_CONF_OFFSET,
485-
offsetof(ngx_http_grpc_loc_conf_t, sign_certificate),
478+
offsetof(ngx_http_grpc_loc_conf_t, upstream.sign_certificate),
486479
NULL },
487480

488481
{ ngx_string("grpc_ssl_sign_certificate_key"),
489482
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
490483
ngx_conf_set_str_slot,
491484
NGX_HTTP_LOC_CONF_OFFSET,
492-
offsetof(ngx_http_grpc_loc_conf_t, sign_certificate_key),
485+
offsetof(ngx_http_grpc_loc_conf_t, upstream.sign_certificate_key),
493486
NULL },
494487

495488
#endif
@@ -4548,14 +4541,14 @@ ngx_http_grpc_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
45484541
if (conf->upstream.enable_ntls == NULL) {
45494542
conf->upstream.enable_ntls = prev->upstream.enable_ntls;
45504543
}
4551-
ngx_conf_merge_str_value(conf->enc_certificate,
4552-
prev->enc_certificate, "");
4553-
ngx_conf_merge_str_value(conf->enc_certificate_key,
4554-
prev->enc_certificate_key, "");
4555-
ngx_conf_merge_str_value(conf->sign_certificate,
4556-
prev->sign_certificate, "");
4557-
ngx_conf_merge_str_value(conf->sign_certificate_key,
4558-
prev->sign_certificate_key, "");
4544+
ngx_conf_merge_str_value(conf->upstream.enc_certificate,
4545+
prev->upstream.enc_certificate, "");
4546+
ngx_conf_merge_str_value(conf->upstream.enc_certificate_key,
4547+
prev->upstream.enc_certificate_key, "");
4548+
ngx_conf_merge_str_value(conf->upstream.sign_certificate,
4549+
prev->upstream.sign_certificate, "");
4550+
ngx_conf_merge_str_value(conf->upstream.sign_certificate_key,
4551+
prev->upstream.sign_certificate_key, "");
45594552
conf->upstream.ssl_ciphers = conf->ssl_ciphers;
45604553
#endif
45614554
#endif
@@ -5016,8 +5009,8 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
50165009
}
50175010

50185011
if (ngx_ssl_certificate(cf, glcf->upstream.ssl,
5019-
&glcf->upstream.ssl_certificate->value,
5020-
&glcf->upstream.ssl_certificate_key->value,
5012+
&glcf->upstream.enc_certificate->value,
5013+
&glcf->upstream.enc_certificate_key->value,
50215014
glcf->upstream.ssl_passwords,
50225015
SSL_ENC_CERT)
50235016
!= NGX_OK)
@@ -5036,8 +5029,8 @@ ngx_http_grpc_set_ssl(ngx_conf_t *cf, ngx_http_grpc_loc_conf_t *glcf)
50365029
}
50375030

50385031
if (ngx_ssl_certificate(cf, glcf->upstream.ssl,
5039-
&glcf->upstream.ssl_certificate->value,
5040-
&glcf->upstream.ssl_certificate_key->value,
5032+
&glcf->upstream.sign_certificate,
5033+
&glcf->upstream.sign_certificate_key,
50415034
glcf->upstream.ssl_passwords,
50425035
SSL_SIGN_CERT)
50435036
!= NGX_OK)

‎src/http/modules/ngx_http_proxy_module.c‎

Lines changed: 24 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -125,13 +125,6 @@ typedef struct {
125125
ngx_str_t ssl_trusted_certificate;
126126
ngx_str_t ssl_crl;
127127
ngx_array_t *ssl_conf_commands;
128-
129-
#if (T_NGX_SSL_NTLS)
130-
ngx_str_t enc_certificate;
131-
ngx_str_t enc_certificate_key;
132-
ngx_str_t sign_certificate;
133-
ngx_str_t sign_certificate_key;
134-
#endif
135128
#endif
136129
} ngx_http_proxy_loc_conf_t;
137130

@@ -804,28 +797,28 @@ static ngx_command_t ngx_http_proxy_commands[] = {
804797
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
805798
ngx_conf_set_str_slot,
806799
NGX_HTTP_LOC_CONF_OFFSET,
807-
offsetof(ngx_http_proxy_loc_conf_t, enc_certificate),
800+
offsetof(ngx_http_proxy_loc_conf_t, upstream.enc_certificate),
808801
NULL },
809802

810803
{ ngx_string("proxy_ssl_enc_certificate_key"),
811804
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
812805
ngx_conf_set_str_slot,
813806
NGX_HTTP_LOC_CONF_OFFSET,
814-
offsetof(ngx_http_proxy_loc_conf_t, enc_certificate_key),
807+
offsetof(ngx_http_proxy_loc_conf_t, upstream.enc_certificate_key),
815808
NULL },
816809

817810
{ ngx_string("proxy_ssl_sign_certificate"),
818811
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
819812
ngx_conf_set_str_slot,
820813
NGX_HTTP_LOC_CONF_OFFSET,
821-
offsetof(ngx_http_proxy_loc_conf_t, sign_certificate),
814+
offsetof(ngx_http_proxy_loc_conf_t, upstream.sign_certificate),
822815
NULL },
823816

824817
{ ngx_string("proxy_ssl_sign_certificate_key"),
825818
NGX_HTTP_MAIN_CONF|NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_TAKE1,
826819
ngx_conf_set_str_slot,
827820
NGX_HTTP_LOC_CONF_OFFSET,
828-
offsetof(ngx_http_proxy_loc_conf_t, sign_certificate_key),
821+
offsetof(ngx_http_proxy_loc_conf_t, upstream.sign_certificate_key),
829822
NULL },
830823
#endif
831824
#endif
@@ -3817,14 +3810,14 @@ ngx_http_proxy_merge_loc_conf(ngx_conf_t *cf, void *parent, void *child)
38173810
if (conf->upstream.enable_ntls == NULL) {
38183811
conf->upstream.enable_ntls = prev->upstream.enable_ntls;
38193812
}
3820-
ngx_conf_merge_str_value(conf->enc_certificate,
3821-
prev->enc_certificate, "");
3822-
ngx_conf_merge_str_value(conf->enc_certificate_key,
3823-
prev->enc_certificate_key, "");
3824-
ngx_conf_merge_str_value(conf->sign_certificate,
3825-
prev->sign_certificate, "");
3826-
ngx_conf_merge_str_value(conf->sign_certificate_key,
3827-
prev->sign_certificate_key, "");
3813+
ngx_conf_merge_str_value(conf->upstream.enc_certificate,
3814+
prev->upstream.enc_certificate, "");
3815+
ngx_conf_merge_str_value(conf->upstream.enc_certificate_key,
3816+
prev->upstream.enc_certificate_key, "");
3817+
ngx_conf_merge_str_value(conf->upstream.sign_certificate,
3818+
prev->upstream.sign_certificate, "");
3819+
ngx_conf_merge_str_value(conf->upstream.sign_certificate_key,
3820+
prev->upstream.sign_certificate_key, "");
38283821
conf->upstream.ssl_ciphers = conf->ssl_ciphers;
38293822
#endif
38303823
#endif
@@ -5063,18 +5056,19 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
50635056

50645057
#if (T_NGX_SSL_NTLS)
50655058
plcf->upstream.tls_method = SSL_CTX_get_ssl_method(plcf->upstream.ssl->ctx);
5066-
if (plcf->enc_certificate.len) {
5059+
if (plcf->upstream.enc_certificate.len) {
50675060

5068-
if (plcf->enc_certificate_key.len == 0) {
5061+
if (plcf->upstream.enc_certificate_key.len == 0) {
50695062
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
50705063
"no \"proxy_ssl_enc_certificate_key\" is defined "
5071-
"for certificate \"%V\"", &plcf->enc_certificate);
5064+
"for certificate \"%V\"",
5065+
&plcf->upstream.enc_certificate);
50725066
return NGX_ERROR;
50735067
}
50745068

50755069
if (ngx_ssl_certificate(cf, plcf->upstream.ssl,
5076-
&plcf->upstream.ssl_certificate->value,
5077-
&plcf->upstream.ssl_certificate_key->value,
5070+
&plcf->upstream.enc_certificate,
5071+
&plcf->upstream.enc_certificate_key,
50785072
plcf->upstream.ssl_passwords,
50795073
SSL_ENC_CERT)
50805074
!= NGX_OK)
@@ -5083,18 +5077,19 @@ ngx_http_proxy_set_ssl(ngx_conf_t *cf, ngx_http_proxy_loc_conf_t *plcf)
50835077
}
50845078
}
50855079

5086-
if (plcf->sign_certificate.len) {
5080+
if (plcf->upstream.sign_certificate.len) {
50875081

5088-
if (plcf->sign_certificate_key.len == 0) {
5082+
if (plcf->upstream.sign_certificate_key.len == 0) {
50895083
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
50905084
"no \"proxy_ssl_sign_certificate_key\" is defined "
5091-
"for certificate \"%V\"", &plcf->sign_certificate);
5085+
"for certificate \"%V\"",
5086+
&plcf->upstream.sign_certificate);
50925087
return NGX_ERROR;
50935088
}
50945089

50955090
if (ngx_ssl_certificate(cf, plcf->upstream.ssl,
5096-
&plcf->upstream.ssl_certificate->value,
5097-
&plcf->upstream.ssl_certificate_key->value,
5091+
&plcf->upstream.sign_certificate,
5092+
&plcf->upstream.sign_certificate_key,
50985093
plcf->upstream.ssl_passwords,
50995094
SSL_SIGN_CERT)
51005095
!= NGX_OK)

‎src/http/modules/ngx_http_ssl_module.c‎

Lines changed: 48 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -843,7 +843,40 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
843843
conf->file, conf->line);
844844
return NGX_CONF_ERROR;
845845
}
846+
#if (T_NGX_SSL_NTLS)
847+
} else if (conf->enc_certificate.len != 0 || conf->sign_certificate.len != 0) {
848+
if (conf->enc_certificate.len == 0) {
849+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
850+
"no \"ssl_enc_certificate\" is defined for "
851+
"the \"ssl\" directive in %s:%ui",
852+
conf->file, conf->line);
853+
return NGX_CONF_ERROR;
854+
}
855+
856+
if (conf->sign_certificate.len == 0) {
857+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
858+
"no \"ssl_sign_certificate\" is defined for "
859+
"the \"ssl\" directive in %s:%ui",
860+
conf->file, conf->line);
861+
return NGX_CONF_ERROR;
862+
}
846863

864+
if (conf->enc_certificate_key.len == 0) {
865+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
866+
"no \"ssl_enc_certificate_key\" is defined for "
867+
"the \"ssl\" directive in %s:%ui",
868+
conf->file, conf->line);
869+
return NGX_CONF_ERROR;
870+
}
871+
872+
if (conf->sign_certificate_key.len == 0) {
873+
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
874+
"no \"ssl_sign_certificate_key\" is defined for "
875+
"the \"ssl\" directive in %s:%ui",
876+
conf->file, conf->line);
877+
return NGX_CONF_ERROR;
878+
}
879+
#endif
847880
} else if (!conf->reject_handshake) {
848881
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
849882
"no \"ssl_certificate\" is defined for "
@@ -864,13 +897,8 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
864897
+ conf->certificates->nelts - 1);
865898
return NGX_CONF_ERROR;
866899
}
867-
868-
} else if (!conf->reject_handshake) {
869-
return NGX_CONF_OK;
870-
}
871-
872900
#if (T_NGX_SSL_NTLS)
873-
if (conf->enc_certificate.len != 0 || conf->sign_certificate.len != 0) {
901+
} else if (conf->enc_certificate.len != 0 || conf->sign_certificate.len != 0) {
874902
if (conf->enc_certificate.len == 0) {
875903
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
876904
"no \"ssl_enc_certificate\" is defined for "
@@ -902,8 +930,10 @@ ngx_http_ssl_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
902930
conf->file, conf->line);
903931
return NGX_CONF_ERROR;
904932
}
905-
}
906933
#endif
934+
} else if (!conf->reject_handshake) {
935+
return NGX_CONF_OK;
936+
}
907937

908938
if (ngx_ssl_create(&conf->ssl, conf->protocols, conf) != NGX_OK) {
909939
return NGX_CONF_ERROR;
@@ -1534,9 +1564,19 @@ ngx_http_ssl_init(ngx_conf_t *cf)
15341564
continue;
15351565
}
15361566

1567+
#if (T_NGX_SSL_NTLS)
1568+
if (sscf->sign_certificate.len > 0 || sscf->enc_certificate.len > 0) {
1569+
continue;
1570+
}
1571+
#endif
15371572
if (!sscf->reject_handshake) {
15381573
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
1574+
#if (T_NGX_SSL_NTLS)
1575+
"no \"ssl_certificate\", \"ssl_enc_certificate\" "
1576+
"or \"ssl_sign_certificate\" is defined for "
1577+
#else
15391578
"no \"ssl_certificate\" is defined for "
1579+
#endif
15401580
"the \"listen ... ssl\" directive in %s:%ui",
15411581
cscf->file_name, cscf->line);
15421582
return NGX_ERROR;
@@ -1561,7 +1601,7 @@ ngx_http_ssl_init(ngx_conf_t *cf)
15611601
if (sscf->sign_certificate.len > 0 || sscf->enc_certificate.len > 0) {
15621602
continue;
15631603
}
1564-
#endif
1604+
#endif
15651605
ngx_log_error(NGX_LOG_EMERG, cf->log, 0,
15661606
#if (T_NGX_SSL_NTLS)
15671607
"no \"ssl_certificate\", \"ssl_enc_certificate\" "

0 commit comments

Comments
 (0)