openresty / openresty/lua-resty-websocket

ssl session repeated sslhandshake

Open
#79 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Lua
Stars
523
Forks
112
Avg merge
1d 16m
Merged PRs (30d)
2

Description

branch : master

https://github.com/openresty/lua-resty-websocket/blob/eba3e979620f847fc6bdb3f64e9adf86b59a0251/lib/resty/websocket/client.lua#L172

 if scheme == "wss" then
        if not ssl_support then
            return nil, "ngx_lua 0.9.11+ required for SSL sockets"
        end
        if client_cert then
            ok, err = sock:setclientcert(client_cert, client_priv_key)
            if not ok then
                return nil, "failed to set TLS client certificate: " .. err
            end
        end
        ok, err = sock:sslhandshake(false, server_name, ssl_verify)
        if not ok then
            return nil, "ssl handshake failed: " .. err
        end
    end

According to the api manual https://www.kancloud.cn/qq13867685/openresty-api-cn/159103
session, err = tcpsock:sslhandshake(reused_session?, server_name?, ssl_verify?)

I think it is nesseary to change the code:

 if scheme == "wss" then
        if not ssl_support then
            return nil, "ngx_lua 0.9.11+ required for SSL sockets"
        end
        if client_cert then
            ok, err = sock:setclientcert(client_cert, client_priv_key)
            if not ok then
                return nil, "failed to set TLS client certificate: " .. err
            end
        end
    end

    -- check for connections from pool:

    local count, err = sock:getreusedtimes()
    if not count then
        return nil, "failed to get reused times: " .. err
    end
    if count > 0 then
        -- being a reused connection (must have done handshake)
        return 1
   else
       local  ok, err = sock:sslhandshake(false, server_name, ssl_verify)
        if not ok then
            return nil, "ssl handshake failed: " .. err
        end
    end

Added: Determine if the sslhandshake is necessary by 'sock:getreusedtimes()' .It do need to call sslhandshake when the reused time of connection is zero.

refer to https://github.com/doujiang24/lua-resty-kafka/blob/3fbed91d81d4fb32d4dda4316f5f2cba04622633/lib/resty/kafka/broker.lua#L144

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at lib/resty/websocket/client.lua around line 172, then read the ngx_lua sslhandshake and getreusedtimes API semantics and the referenced lua-resty-kafka broker.lua implementation. Verify the wss connection-pool path and define completion as avoiding a repeated handshake for reused connections while preserving initial-handshake error handling.

Written by the indexing model from the issue text.

Assessment

Tech stack
lua
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.