Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ssl session repeated sslhandshake #79

Open
chenyyyang opened this issue Jun 12, 2023 · 2 comments
Open

ssl session repeated sslhandshake #79

chenyyyang opened this issue Jun 12, 2023 · 2 comments

Comments

@chenyyyang
Copy link
Contributor

chenyyyang commented Jun 12, 2023

branch : master

ok, err = sock:sslhandshake(false, server_name, ssl_verify)

 if scheme == "wss" then
        if not ssl_support then
            return nil, "ngx_lua 0.9.11+ required for SSL sockets"
        end
        if client_cert then
            ok, err = sock:setclientcert(client_cert, client_priv_key)
            if not ok then
                return nil, "failed to set TLS client certificate: " .. err
            end
        end
        ok, err = sock:sslhandshake(false, server_name, ssl_verify)
        if not ok then
            return nil, "ssl handshake failed: " .. err
        end
    end

According to the api manual https://www.kancloud.cn/qq13867685/openresty-api-cn/159103
session, err = tcpsock:sslhandshake(reused_session?, server_name?, ssl_verify?)

I think it is nesseary to change the code:

 if scheme == "wss" then
        if not ssl_support then
            return nil, "ngx_lua 0.9.11+ required for SSL sockets"
        end
        if client_cert then
            ok, err = sock:setclientcert(client_cert, client_priv_key)
            if not ok then
                return nil, "failed to set TLS client certificate: " .. err
            end
        end
    end

    -- check for connections from pool:

    local count, err = sock:getreusedtimes()
    if not count then
        return nil, "failed to get reused times: " .. err
    end
    if count > 0 then
        -- being a reused connection (must have done handshake)
        return 1
   else
       local  ok, err = sock:sslhandshake(false, server_name, ssl_verify)
        if not ok then
            return nil, "ssl handshake failed: " .. err
        end
    end

Added: Determine if the sslhandshake is necessary by 'sock:getreusedtimes()' .It do need to call sslhandshake when the reused time of connection is zero.

refer to https://github.com/doujiang24/lua-resty-kafka/blob/3fbed91d81d4fb32d4dda4316f5f2cba04622633/lib/resty/kafka/broker.lua#L144

@zhuizhuhaomeng
Copy link
Contributor

PR is welcomed. @chenyyyang

@chenyyyang
Copy link
Contributor Author

Hi @zhuizhuhaomeng Could you mind rewiew this PR :#80

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants