https verification doesn't work in ngx.timer invoked from init_worker

[oik741]

Hi guys,
I've got a function that makes HTTPS request
if this function invoked from worker context - everything works
if function invoked from ngx.timer context - everything works
if function invoked by ngx.timer from init_worker_by_lua context - https verification doesn't work =)

I'm using Openresty Bundle 1.9.7.3
nginx.conf
test_https.lua

OS: reproduced on fedora 23 and centos 7.1

Bundle compiled with such opts:
./configure --prefix=/opt/openresty --with-http_gzip_static_module --with-http_image_filter_module --with-http_ssl_module --with-http_stub_status_module --with-http_v2_module --with-luajit --with-pcre-jit --with-debug

LOGS

Can someone help me and explain what i'm doing wrong?

[agentzh]

@oik741 Thanks for the report. It looks like a bug in ngx_lua that init_worker_by_lua* does not inherit the lua_ssl_verify_depth and lua_ssl_trusted_certificate configurations on the top level of http {} as expected. Will you contribute a patch for it?

[oik741]

Sure @agentzh , I'll try to do it =)

[agentzh]

@oik741 Okay, I've attempted a fix. Will you please try the following patch for this module on your side?

diff --git a/src/ngx_http_lua_initworkerby.c b/src/ngx_http_lua_initworkerby.c
index 8a374c2..6754b4b 100644
--- a/src/ngx_http_lua_initworkerby.c
+++ b/src/ngx_http_lua_initworkerby.c
@@ -34,7 +34,7 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle)
     ngx_http_request_t          *r = NULL;
     ngx_http_lua_ctx_t          *ctx;
     ngx_http_conf_ctx_t         *conf_ctx, http_ctx;
-    ngx_http_lua_loc_conf_t     *llcf, *top_llcf;
+    ngx_http_lua_loc_conf_t     *top_llcf;
     ngx_http_lua_main_conf_t    *lmcf;
     ngx_http_core_loc_conf_t    *clcf, *top_clcf;

@@ -198,9 +198,17 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle)
             http_ctx.loc_conf[modules[i]->ctx_index] = cur;

             if (module->merge_loc_conf) {
-                prev = module->create_loc_conf(&conf);
-                if (prev == NULL) {
-                    return NGX_ERROR;
+                if (modules[i] == &ngx_http_lua_module) {
+                    prev = top_llcf;
+
+                } else if (modules[i] == &ngx_http_core_module) {
+                    prev = top_clcf;
+
+                } else {
+                    prev = module->create_loc_conf(&conf);
+                    if (prev == NULL) {
+                        return NGX_ERROR;
+                    }
                 }

                 rv = module->merge_loc_conf(&conf, prev, cur);
@@ -254,10 +262,6 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle)

 #endif

-    if (top_clcf->resolver) {
-        clcf->resolver = top_clcf->resolver;
-    }
-
     ctx = ngx_http_lua_create_ctx(r);
     if (ctx == NULL) {
         goto failed;
@@ -267,11 +271,6 @@ ngx_http_lua_init_worker(ngx_cycle_t *cycle)
     ctx->cur_co_ctx = NULL;
     r->read_event_handler = ngx_http_block_reading;

-    llcf = ngx_http_get_module_loc_conf(r, ngx_http_lua_module);
-    if (top_llcf->log_socket_errors != NGX_CONF_UNSET) {
-        llcf->log_socket_errors = top_llcf->log_socket_errors;
-    }
-
     ngx_http_lua_set_req(lmcf->lua, r);

     (void) lmcf->init_worker_handler(cycle->log, lmcf, lmcf->lua);

[oik741]

@agentzh thanks for your help,
I've checked this patch, verification works now

[agentzh]

@oik741 Thanks for your feedback! I've just submitted the patch to git master.