Skip to content

Commit 2557fb5

Browse files
bavshin-f5bavshin-f5
committed
ACME: remove per-issuer resolver configuration.
The resolver configuration is an implementation detail that might become unneeded in the future, thus we should avoid exposing it unless absolutely necessary.
1 parent c70dc3e commit 2557fb5

File tree

5 files changed

+21
-94
lines changed

5 files changed

+21
-94
lines changed

‎README.md

Lines changed: 3 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,9 @@ the linker to perform LTO and dead code elimination.
4646
## How to Use
4747

4848
Add the module to the nginx configuration and configure as described below.
49+
Note that this module requires a [resolver] configuration in the `http` block.
50+
51+
[resolver]: https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver
4952

5053
## Example Configuration
5154

@@ -139,35 +142,6 @@ explicitly.
139142

140143
Can be specified multiple times.
141144

142-
### resolver
143-
144-
**Syntax:** resolver `address` ... [ `valid` = `time` ] [ `ipv4` = `on` | `off` ] [ `ipv6` = `on` | `off` ] [ `status_zone` = `zone` ]
145-
146-
**Default:** -
147-
148-
**Context:** acme_issuer
149-
150-
Configures name servers used to resolve names of upstream servers into
151-
addresses.
152-
See [resolver](https://nginx.org/en/docs/http/ngx_http_core_module.html#resolver)
153-
for the parameter reference.
154-
155-
Required, but can be inherited from the `http` block.
156-
### resolver_timeout
157-
158-
**Syntax:** resolver_timeout `time`
159-
160-
**Default:** 30s
161-
162-
**Context:** acme_issuer
163-
164-
Sets a timeout for name resolution, for example:
165-
166-
```nginx
167-
resolver_timeout 5s;
168-
169-
```
170-
171145
### ssl_trusted_certificate
172146

173147
**Syntax:** ssl_trusted_certificate `file`

‎src/conf.rs

Lines changed: 1 addition & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -74,7 +74,7 @@ pub static mut NGX_HTTP_ACME_COMMANDS: [ngx_command_t; 4] = [
7474
ngx_command_t::empty(),
7575
];
7676

77-
static mut NGX_HTTP_ACME_ISSUER_COMMANDS: [ngx_command_t; 10] = [
77+
static mut NGX_HTTP_ACME_ISSUER_COMMANDS: [ngx_command_t; 8] = [
7878
ngx_command_t {
7979
name: ngx_string!("uri"),
8080
type_: NGX_CONF_TAKE1 as ngx_uint_t,
@@ -99,22 +99,6 @@ static mut NGX_HTTP_ACME_ISSUER_COMMANDS: [ngx_command_t; 10] = [
9999
offset: 0,
100100
post: ptr::null_mut(),
101101
},
102-
ngx_command_t {
103-
name: ngx_string!("resolver"),
104-
type_: NGX_CONF_TAKE1 as ngx_uint_t,
105-
set: Some(cmd_issuer_set_resolver),
106-
conf: 0,
107-
offset: 0,
108-
post: ptr::null_mut(),
109-
},
110-
ngx_command_t {
111-
name: ngx_string!("resolver_timeout"),
112-
type_: NGX_CONF_TAKE1 as ngx_uint_t,
113-
set: Some(nginx_sys::ngx_conf_set_msec_slot),
114-
conf: 0,
115-
offset: mem::offset_of!(Issuer, resolver_timeout),
116-
post: ptr::null_mut(),
117-
},
118102
ngx_command_t {
119103
name: ngx_string!("ssl_trusted_certificate"),
120104
type_: NGX_CONF_TAKE1 as ngx_uint_t,
@@ -394,32 +378,6 @@ extern "C" fn cmd_issuer_set_account_key(
394378
NGX_CONF_OK
395379
}
396380

397-
extern "C" fn cmd_issuer_set_resolver(
398-
cf: *mut ngx_conf_t,
399-
_cmd: *mut ngx_command_t,
400-
conf: *mut c_void,
401-
) -> *mut c_char {
402-
let cf = unsafe { cf.as_mut().expect("cf") };
403-
let issuer = unsafe { conf.cast::<Issuer>().as_mut().expect("issuer conf") };
404-
405-
if issuer.resolver.is_some() {
406-
return NGX_CONF_DUPLICATE;
407-
}
408-
409-
let args = unsafe { &mut *cf.args };
410-
let value: *mut ngx_str_t = args.elts.cast();
411-
412-
issuer.resolver = ptr::NonNull::new(unsafe {
413-
nginx_sys::ngx_resolver_create(cf, value.add(1), args.nelts - 1)
414-
});
415-
416-
if issuer.resolver.is_none() {
417-
return NGX_CONF_ERROR;
418-
}
419-
420-
NGX_CONF_OK
421-
}
422-
423381
extern "C" fn cmd_issuer_set_uri(
424382
cf: *mut ngx_conf_t,
425383
_cmd: *mut ngx_command_t,

‎src/conf/issuer.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ pub enum IssuerError {
5959
AccountKey(super::ssl::CertificateFetchError),
6060
#[error("cannot generate account key: {0}")]
6161
AccountKeyGen(#[from] super::pkey::PKeyGenError),
62-
#[error("resolver is not configured")]
62+
#[error("\"resolver\" is not configured")]
6363
Resolver,
6464
#[error("memory allocation failed")]
6565
Alloc(#[from] AllocError),

‎t/acme_conf_certificate.t

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,10 @@ http {
5454
5555
acme_issuer example {
5656
uri https://localhost:%%PORT_9000%%/dir;
57-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
58-
ssl_verify off;
57+
ssl_verify off;
5958
}
59+
60+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
6061
}
6162
6263
EOF

‎t/acme_conf_issuer.t

Lines changed: 13 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ use Test::Nginx;
2424
select STDERR; $| = 1;
2525
select STDOUT; $| = 1;
2626

27-
my $t = Test::Nginx->new()->has(qw/http http_ssl/)->plan(8);
27+
my $t = Test::Nginx->new()->has(qw/http http_ssl/)->plan(7);
2828

2929
use constant TEMPLATE_CONF => <<'EOF';
3030
@@ -68,29 +68,18 @@ acme_issuer example {
6868
uri https://localhost:%%PORT_9000%%/dir;
6969
account_key ecdsa:256;
7070
contact [email protected];
71-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
72-
resolver_timeout 5s;
7371
ssl_verify off;
7472
state_path %%TESTDIR%%;
7573
accept_terms_of_service;
7674
}
7775
78-
EOF
79-
80-
81-
is(check($t, <<'EOF' ), undef, 'valid - resolver in server');
82-
83-
acme_issuer example {
84-
uri https://localhost:%%PORT_9000%%/dir;
85-
ssl_verify off;
86-
}
87-
8876
resolver 127.0.0.1:%%PORT_8980_UDP%%;
77+
resolver_timeout 5s;
8978
9079
EOF
9180

9281

93-
like(check($t, <<'EOF' ), qr/\[emerg].*resolver is not/, 'no resolver');
82+
like(check($t, <<'EOF' ), qr/\[emerg].*"resolver" is not/, 'no resolver');
9483
9584
acme_issuer example {
9685
uri https://localhost:%%PORT_9000%%/dir;
@@ -106,10 +95,11 @@ acme_shared_zone bad-value;
10695
10796
acme_issuer example {
10897
uri https://localhost:%%PORT_9000%%/dir;
109-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
11098
ssl_verify off;
11199
}
112100
101+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
102+
113103
EOF
114104

115105

@@ -119,10 +109,11 @@ acme_shared_zone zone=test:bad-size;
119109
120110
acme_issuer example {
121111
uri https://localhost:%%PORT_9000%%/dir;
122-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
123112
ssl_verify off;
124113
}
125114
115+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
116+
126117
EOF
127118

128119

@@ -131,10 +122,11 @@ like(check($t, <<'EOF' ), qr/\[emerg].*cannot load/, 'bad key file');
131122
acme_issuer example {
132123
uri https://localhost:%%PORT_9000%%/dir;
133124
account_key no-such-file.key;
134-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
135125
ssl_verify off;
136126
}
137127
128+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
129+
138130
EOF
139131

140132

@@ -143,10 +135,11 @@ like(check($t, <<'EOF' ), qr/\[emerg].*unsupported curve/, 'bad key curve');
143135
acme_issuer example {
144136
uri https://localhost:%%PORT_9000%%/dir;
145137
account_key ecdsa:234;
146-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
147138
ssl_verify off;
148139
}
149140
141+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
142+
150143
EOF
151144

152145

@@ -155,10 +148,11 @@ like(check($t, <<'EOF' ), qr/\[emerg].*unsupported key size/, 'bad key size');
155148
acme_issuer example {
156149
uri https://localhost:%%PORT_9000%%/dir;
157150
account_key rsa:1024;
158-
resolver 127.0.0.1:%%PORT_8980_UDP%%;
159151
ssl_verify off;
160152
}
161153
154+
resolver 127.0.0.1:%%PORT_8980_UDP%%;
155+
162156
EOF
163157

164158
# stop and clear the log to avoid triggering sanitizer checks

0 commit comments

Comments
 (0)