Skip to content

Commit 5027a0a

Browse files
spacewanderspacewander
authored
feat: allow setting TCP over TLS dynamically (#32)
1 parent abc4a76 commit 5027a0a

File tree

11 files changed

+269
-9
lines changed

11 files changed

+269
-9
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,8 @@ jobs:
2626
2727
- name: Install
2828
run: |
29-
wget https://raw.githubusercontent.com/api7/apisix-build-tools/master/build-apisix-base.sh
29+
# TODO: change it back once we have merged it
30+
wget https://raw.githubusercontent.com/api7/apisix-build-tools/stream-apisix/build-apisix-base.sh
3031
chmod +x build-apisix-base.sh
3132
OR_PREFIX=$OPENRESTY_PREFIX ./build-apisix-base.sh latest
3233

‎Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,3 +6,5 @@ INSTALL ?= install
66
install:
77
$(INSTALL) -d $(OPENRESTY_PREFIX)/lualib/resty/apisix/
88
$(INSTALL) -m 664 lib/resty/apisix/*.lua $(OPENRESTY_PREFIX)/lualib/resty/apisix/
9+
$(INSTALL) -d $(OPENRESTY_PREFIX)/lualib/resty/apisix/stream
10+
$(INSTALL) -m 664 lib/resty/apisix/stream/*.lua $(OPENRESTY_PREFIX)/lualib/resty/apisix/stream

‎lib/resty/apisix/stream/upstream.lua‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
local ffi = require("ffi")
2+
local base = require("resty.core.base")
3+
local get_request = base.get_request
4+
local C = ffi.C
5+
local NGX_ERROR = ngx.ERROR
6+
7+
8+
base.allows_subsystem("stream")
9+
10+
11+
ffi.cdef([[
12+
typedef intptr_t ngx_int_t;
13+
ngx_int_t
14+
ngx_stream_apisix_upstream_enable_tls(ngx_stream_lua_request_t *r);
15+
]])
16+
local _M = {}
17+
18+
19+
function _M.set_tls()
20+
-- Unlike Kong, we choose to enable TLS instead of disabling it by Lua method.
21+
-- This way is more intuitive.
22+
-- The side effect is that we need to change Nginx to check `ssl_enable` flag instead.
23+
local r = get_request()
24+
local rc = C.ngx_stream_apisix_upstream_enable_tls(r)
25+
if rc == NGX_ERROR then
26+
return nil, "error while setting upstream tls"
27+
end
28+
29+
return true
30+
end
31+
32+
33+
return _M

‎patch/1.19.9/nginx-tcp_over_tls.patch‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
diff --git src/stream/ngx_stream_proxy_module.c src/stream/ngx_stream_proxy_module.c
2+
index b3d8a43..424c381 100644
3+
--- src/stream/ngx_stream_proxy_module.c
4+
+++ src/stream/ngx_stream_proxy_module.c
5+
@@ -8,6 +8,9 @@
6+
#include <ngx_config.h>
7+
#include <ngx_core.h>
8+
#include <ngx_stream.h>
9+
+#if (NGX_STREAM_APISIX)
10+
+#include <ngx_stream_apisix_module.h>
11+
+#endif
12+
13+
14+
typedef struct {
15+
@@ -812,7 +815,13 @@ ngx_stream_proxy_init_upstream(ngx_stream_session_t *s)
16+
17+
#if (NGX_STREAM_SSL)
18+
19+
+#if (NGX_STREAM_APISIX)
20+
+ if (pc->type == SOCK_STREAM &&
21+
+ (ngx_stream_apisix_is_proxy_ssl_enabled(s) || pscf->ssl_enable))
22+
+ {
23+
+#else
24+
if (pc->type == SOCK_STREAM && pscf->ssl) {
25+
+#endif
26+
27+
if (u->proxy_protocol) {
28+
if (ngx_stream_proxy_send_proxy_protocol(s) != NGX_OK) {
29+
@@ -2126,7 +2135,11 @@ ngx_stream_proxy_merge_srv_conf(ngx_conf_t *cf, void *parent, void *child)
30+
ngx_conf_merge_ptr_value(conf->ssl_conf_commands,
31+
prev->ssl_conf_commands, NULL);
32+
33+
+#if (NGX_STREAM_APISIX)
34+
+ if (ngx_stream_proxy_set_ssl(cf, conf) != NGX_OK) {
35+
+#else
36+
if (conf->ssl_enable && ngx_stream_proxy_set_ssl(cf, conf) != NGX_OK) {
37+
+#endif
38+
return NGX_CONF_ERROR;
39+
}
40+

‎patch/1.19.9/ngx_stream_lua-expose_request_struct.patch‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
diff --git src/api/ngx_stream_lua_api.h src/api/ngx_stream_lua_api.h
2+
index 92f933d..812e0c4 100644
3+
--- src/api/ngx_stream_lua_api.h
4+
+++ src/api/ngx_stream_lua_api.h
5+
@@ -20,6 +20,10 @@
6+
#include <ngx_core.h>
7+
8+
9+
+#if (NGX_STREAM_APISIX)
10+
+#include <ngx_stream.h>
11+
+#include "../ngx_stream_lua_request.h"
12+
+#endif
13+
14+
15+
#include <lua.h>

‎patch/README.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,9 @@ We have modified them a lot and even changed the API.
66
The `*-upstream_mtls` patches originally come from the Kong's kong-build-tools and lua-kong-nginx-module
77
projects, which is also under Apache-2.0 License.
88

9+
The `*-expose_request_struct.patch` patches originally come from the Kong's kong-build-tools
10+
projects, which is also under Apache-2.0 License.
11+
912
The `*-ngx_pipe_environ_on_mac` patches support the environ argument of the ngx.pipe.spawn function on macos.
1013

1114
The `*-enable_keepalive` patches originally come from:

‎src/stream/config‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
ngx_module_type=STREAM
2+
ngx_module_name=ngx_stream_apisix_module
3+
ngx_module_srcs="$ngx_addon_dir/ngx_stream_apisix_module.c"
4+
ngx_module_deps=$ngx_addon_dir/ngx_stream_apisix_module.h
5+
ngx_module_incs="$ngx_addon_dir/"
6+
7+
. auto/module
8+
9+
ngx_addon_name=$ngx_module_name
10+
11+
have=NGX_STREAM_APISIX . auto/have

‎src/stream/ngx_stream_apisix_module.c‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
#include <ngx_stream.h>
2+
#include <ngx_stream_lua_api.h>
3+
#include "ngx_stream_apisix_module.h"
4+
5+
6+
typedef struct {
7+
unsigned proxy_ssl_enabled:1;
8+
} ngx_stream_apisix_ctx_t;
9+
10+
11+
static ngx_stream_module_t ngx_stream_apisix_module_ctx = {
12+
NULL, /* preconfiguration */
13+
NULL, /* postconfiguration */
14+
15+
NULL, /* create main configuration */
16+
NULL, /* init main configuration */
17+
18+
NULL, /* create server configuration */
19+
NULL, /* merge server configuration */
20+
};
21+
22+
23+
ngx_module_t ngx_stream_apisix_module = {
24+
NGX_MODULE_V1,
25+
&ngx_stream_apisix_module_ctx, /* module context */
26+
NULL, /* module directives */
27+
NGX_STREAM_MODULE, /* module type */
28+
NULL, /* init master */
29+
NULL, /* init module */
30+
NULL, /* init process */
31+
NULL, /* init thread */
32+
NULL, /* exit thread */
33+
NULL, /* exit process */
34+
NULL, /* exit master */
35+
NGX_MODULE_V1_PADDING
36+
};
37+
38+
39+
ngx_int_t
40+
ngx_stream_apisix_upstream_enable_tls(ngx_stream_lua_request_t *r)
41+
{
42+
ngx_stream_apisix_ctx_t *ctx;
43+
44+
ctx = ngx_stream_lua_get_module_ctx(r, ngx_stream_apisix_module);
45+
if (ctx == NULL) {
46+
ctx = ngx_pcalloc(r->pool, sizeof(ngx_stream_apisix_ctx_t));
47+
if (ctx == NULL) {
48+
return NGX_ERROR;
49+
}
50+
51+
ngx_stream_lua_set_ctx(r, ctx, ngx_stream_apisix_module);
52+
}
53+
54+
ctx->proxy_ssl_enabled = 1;
55+
56+
return NGX_OK;
57+
}
58+
59+
60+
ngx_int_t
61+
ngx_stream_apisix_is_proxy_ssl_enabled(ngx_stream_session_t *s)
62+
{
63+
ngx_stream_apisix_ctx_t *ctx;
64+
65+
ctx = ngx_stream_get_module_ctx(s, ngx_stream_apisix_module);
66+
67+
return ctx != NULL && ctx->proxy_ssl_enabled;
68+
}

‎src/stream/ngx_stream_apisix_module.h‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
#ifndef _NGX_STREAM_APISIX_H_INCLUDED_
2+
#define _NGX_STREAM_APISIX_H_INCLUDED_
3+
4+
5+
#include <ngx_stream.h>
6+
7+
8+
ngx_int_t ngx_stream_apisix_is_proxy_ssl_enabled(ngx_stream_session_t *s);
9+
10+
11+
#endif /* _NGX_STREAM_APISIX_H_INCLUDED_ */

‎t/APISIX_NGINX.pm‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,20 +18,31 @@ $ENV{TEST_NGINX_SERVER_SSL_PORT} = 23456;
1818
add_block_preprocessor(sub {
1919
my ($block) = @_;
2020

21-
if (!$block->request) {
22-
$block->set_value("request", "GET /t");
23-
}
24-
2521
if (!$block->no_error_log && !$block->error_log) {
2622
$block->set_value("no_error_log", "[error]\n[alert]");
2723
}
2824

29-
my $http_config = $block->http_config // '';
30-
$http_config .= <<_EOC_;
31-
lua_package_path "lib/?.lua;;";
25+
if (defined $block->config) {
26+
if (!$block->request) {
27+
$block->set_value("request", "GET /t");
28+
}
29+
30+
my $http_config = $block->http_config // '';
31+
$http_config .= <<_EOC_;
32+
lua_package_path "lib/?.lua;;";
33+
_EOC_
34+
35+
$block->set_value("http_config", $http_config);
36+
}
37+
38+
if (defined $block->stream_server_config) {
39+
my $stream_config = $block->stream_config // '';
40+
$stream_config .= <<_EOC_;
41+
lua_package_path "lib/?.lua;;";
3242
_EOC_
3343

34-
$block->set_value("http_config", $http_config);
44+
$block->set_value("stream_config", $stream_config);
45+
}
3546
});
3647

3748

0 commit comments

Comments
 (0)