From b1981579e35eed3daccf3c6bd1213819d2318a3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?=E8=80=97=E5=AD=90?= Date: Tue, 3 Nov 2026 05:02:28 +0800 Subject: [PATCH] bugfix: lua_ssl_key_log did not take effect with BoringSSL. BoringSSL always reports OPENSSL_VERSION_NUMBER as 1.1.1, so the version check left HAVE_SSL_KEY_LOG undefined and the directive was accepted but silently ignored, although BoringSSL has long provided SSL_CTX_set_keylog_callback(). The lua_ssl_key_log test now checks the secrets of the last handshake only, in sorted order: the key log file is appended to on every request, and BoringSSL logs the secrets in a different order than OpenSSL. Co-Authored-By: Claude Opus 5.5 --- src/ngx_stream_lua_module.c | 7 ++++++- t/129-ssl-socket.t | 21 +++++++++++++++++---- 2 files changed, 23 insertions(+), 5 deletions(-) diff --git a/src/ngx_stream_lua_module.c b/src/ngx_stream_lua_module.c index 772e8c55..830a2e89 100644 --- a/src/ngx_stream_lua_module.c +++ b/src/ngx_stream_lua_module.c @@ -39,7 +39,12 @@ #include "ngx_stream_lua_prereadby.h" -#if !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x101010afL +/* + * BoringSSL always reports OPENSSL_VERSION_NUMBER as 1.1.1, but does provide + * SSL_CTX_set_keylog_callback() + */ +#if !defined(OPENSSL_VERSION_NUMBER) || OPENSSL_VERSION_NUMBER > 0x101010afL \ + || defined(OPENSSL_IS_BORINGSSL) #define HAVE_SSL_KEY_LOG 1 #endif diff --git a/t/129-ssl-socket.t b/t/129-ssl-socket.t index 2b84087f..ad43b0fa 100644 --- a/t/129-ssl-socket.t +++ b/t/129-ssl-socket.t @@ -3115,8 +3115,21 @@ handshake rejected while SSL handshaking end local key_log = f:read("*a") - ngx.say(key_log) f:close() + + -- the log is appended to on each request, so keep the secrets + -- of the last handshake only, identified by its client random; + -- SSL libraries log them in different orders + local random = key_log:match("(%x+) %x+\n$") + local lines = {} + for line in key_log:gmatch("[^\n]+") do + if line:find(" " .. random .. " ", 1, true) then + lines[#lines + 1] = line + end + end + + table.sort(lines) + ngx.say(table.concat(lines, "\n")) end -- do collectgarbage() } @@ -3127,11 +3140,11 @@ ssl handshake: userdata sent stream request: 53 bytes. received: HTTP/1.1 200 OK close: 1 nil -SERVER_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+ -EXPORTER_SECRET [0-9a-z\s]+ -SERVER_TRAFFIC_SECRET_0 [0-9a-z\s]+ CLIENT_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+ CLIENT_TRAFFIC_SECRET_0 [0-9a-z\s]+ +EXPORTER_SECRET [0-9a-z\s]+ +SERVER_HANDSHAKE_TRAFFIC_SECRET [0-9a-z\s]+ +SERVER_TRAFFIC_SECRET_0 [0-9a-z\s]+ --- log_level: debug --- grep_error_log eval: qr/lua ssl (?:set|save|free) session: [0-9A-F]+/