Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(mtls) update to use newer mTLS api #89

Closed
wants to merge 1 commit into from
Closed

fix(mtls) update to use newer mTLS api #89

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 8 additions & 9 deletions lib/resty/healthcheck.lua
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -899,17 +899,16 @@ function checker:run_single_check(ip, port, hostname, hostheader)
if self.checks.active.type == "https" then
local https_sni, session, err
https_sni = self.checks.active.https_sni or hostheader or hostname

if self.ssl_cert and self.ssl_key then
session, err = sock:tlshandshake({
verify = self.checks.active.https_verify_certificate,
client_cert = self.ssl_cert,
client_priv_key = self.ssl_key,
server_name = https_sni
})
else
session, err = sock:sslhandshake(nil, https_sni,
self.checks.active.https_verify_certificate)
ok, err = sock:setclientcert(self.ssl_cert, self.ssl_key)
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Idea: what if we used feature detection (some combo of if type(sock.setclientcert) == "function" and if type(sock.tlshandshake) == "function") instead of a hard-coded change? In my mind then we would have the flexibility to merge+release this now rather than having one more transitive dependency to carefully update in lockstep with Kong. Replacing the feature detection with the hard-coded behavior could be left as a TODO once OpenResty+Kong are all on the same page, socket feature-wise.

if not ok then
self:log(ERR, "failed to set client certificate: ", err)
end
end

session, err = sock:sslhandshake(nil, https_sni,
self.checks.active.https_verify_certificate)
if not session then
sock:close()
self:log(ERR, "failed SSL handshake with '", hostname or "", " (", ip, ":", port, ")', using server name (sni) '", https_sni, "': ", err)
Expand Down