From 85e1680a10299e3cdca0225c815995640fd74c13 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=80=97=E5=AD=90?= Date: Tue, 3 Nov 2026 05:02:10 +0800 Subject: [PATCH 1/2] bugfix: lua_ssl_key_log did not take effect with BoringSSL. BoringSSL always reports OPENSSL_VERSION_NUMBER as 1.1.1, so the version check left HAVE_SSL_KEY_LOG undefined and the directive was accepted but silently ignored, although BoringSSL has long provided SSL_CTX_set_keylog_callback(). The lua_ssl_key_log test now checks the secrets of the last handshake only, in sorted order: the key log file is appended to on every request, and BoringSSL logs the secrets in a different order than OpenSSL. Co-Authored-By: Claude Opus 5.5 --- src/ngx_http_lua_module.c | 7 ++++++- t/129-ssl-socket.t | 23 ++++++++++++++++++----- 2 files changed, 24 insertions(+), 6 deletions(-) diff --git a/src/ngx_http_lua_module.c b/src/ngx_http_lua_module.c index 19880ff599..56ca2ec0ca 100644 --- a/src/ngx_http_lua_module.c +++ b/src/ngx_http_lua_module.c @@ -42,7 +42,12 @@ #include "ngx_http_lua_pipe.h" #endif -#if !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x101010afL +/* + * BoringSSL always reports OPENSSL_VERSION_NUMBER as 1.1.1, but does provide + * SSL_CTX_set_keylog_callback() + */ +#if !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x101010afL \ + || defined(OPENSSL_IS_BORINGSSL) #define HAVE_SSL_KEY_LOG 1 #endif diff --git a/t/129-ssl-socket.t b/t/129-ssl-socket.t index ea62394972..6ce42ae92a 100644 --- a/t/129-ssl-socket.t +++ b/t/129-ssl-socket.t @@ -3088,8 +3088,21 @@ SSL reused session end local key_log = f:read("*a") - ngx.say(key_log) f:close() + + -- the log is appended to on each request, so keep the secrets + -- of the last handshake only, identified by its client random; + -- SSL libraries log them in different orders + local random = key_log:match("(%x+) %x+\n$") + local lines = {} + for line in key_log:gmatch("[^\n]+") do + if line:find(" " .. random .. " ", 1, true) then + lines[#lines + 1] = line + end + end + + table.sort(lines) + ngx.say(table.concat(lines, "\n")) end -- do collectgarbage() } @@ -3102,16 +3115,16 @@ ssl handshake: cdata sent http request: 53 bytes. received: HTTP/1.1 200 OK close: 1 nil -SERVER_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+ -EXPORTER_SECRET [0-9a-z\s]+ -SERVER_TRAFFIC_SECRET_0 [0-9a-z\s]+ CLIENT_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+ CLIENT_TRAFFIC_SECRET_0 [0-9a-z\s]+ +EXPORTER_SECRET [0-9a-z\s]+ +SERVER_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+ +SERVER_TRAFFIC_SECRET_0 [0-9a-z\s]+ --- log_level: debug --- error_log eval ['lua ssl server name: "test.com"', -qr/SSL: TLSv1.3, cipher: "TLS_AES_256_GCM_SHA384 TLSv1.3/] +qr/SSL: TLSv1\.3, cipher: "TLS_/] --- no_error_log SSL reused session [error] From 2219a4b6940e8021b9e067c243e4fb6f4c8c73d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=80=97=E5=AD=90?= Date: Tue, 3 Nov 2026 05:02:10 +0800 Subject: [PATCH 2/2] feature: allowed ssl.export_keying_material() with BoringSSL. BoringSSL provides SSL_export_keying_material() with the same signature as OpenSSL; only SSL_export_keying_material_early() is missing. Also, old OpenSSL versions got "BoringSSL does not support SSL_export_keying_material" from both functions instead of "OpenSSL too old", and BoringSSL now gets the right function name for the early one. Co-Authored-By: Claude Opus 5.5 --- src/ngx_http_lua_ssl_export_keying_material.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/src/ngx_http_lua_ssl_export_keying_material.c b/src/ngx_http_lua_ssl_export_keying_material.c index ec64c049a9..1763b5d025 100644 --- a/src/ngx_http_lua_ssl_export_keying_material.c +++ b/src/ngx_http_lua_ssl_export_keying_material.c @@ -31,10 +31,7 @@ ngx_http_lua_ffi_ssl_export_keying_material(ngx_http_request_t *r, u_char *out, size_t out_size, const char *label, size_t llen, const u_char *context, size_t ctxlen, int use_ctx, char **err) { -#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER < 0x10101000L - *err = "BoringSSL does not support SSL_export_keying_material"; - return NGX_ERROR; -#elif defined(LIBRESSL_VERSION_NUMBER) +#if defined(LIBRESSL_VERSION_NUMBER) *err = "LibreSSL does not support SSL_export_keying_material"; return NGX_ERROR; #elif OPENSSL_VERSION_NUMBER < 0x10101000L @@ -79,8 +76,8 @@ ngx_http_lua_ffi_ssl_export_keying_material_early(ngx_http_request_t *r, u_char *out, size_t out_size, const char *label, size_t llen, const u_char *context, size_t ctxlen, char **err) { -#if defined(OPENSSL_IS_BORINGSSL) || OPENSSL_VERSION_NUMBER < 0x10101000L - *err = "BoringSSL does not support SSL_export_keying_material"; +#if defined(OPENSSL_IS_BORINGSSL) + *err = "BoringSSL does not support SSL_export_keying_material_early"; return NGX_ERROR; #elif defined(LIBRESSL_VERSION_NUMBER) *err = "LibreSSL does not support SSL_export_keying_material";