我正在使用OpenResty动态生成SSL证书。在运行ssl_certificate_by_lua_block
之前,我试图找出请求的用户代理,并决定是否继续执行请求。
我发现ssl_client_hello_by_lua_block
指令在ssl_certificate_by_lua_block
之前运行,但是如果我试图在ssl_client_hello_by_lua_block
中执行ngx.req.get_headers()["user-agent"]
,我会得到以下错误
2022/06/13 09:20:58 [error] 31918#31918: *18 lua entry thread aborted: runtime error: ssl_client_hello_by_lua:6: API disabled in the current context
stack traceback:
coroutine 0:
[C]: in function 'error'
/usr/local/openresty/lualib/resty/core/request.lua:140: in function 'get_headers'
ssl_client_hello_by_lua:6: in main chunk, context: ssl_client_hello_by_lua*, client: 1.2.3.4, server: 0.0.0.0:443
我试过rewrite_by_lua_block
,但它运行在ssl_certificate_by_lua_block
之后
有什么指令可以让我访问ngx.req.get_headers()["user-agent"]
并在ssl_certificate_by_lua_block
之前运行吗?
我的Nginx公司可供参考。
nginx.conf
# HTTPS server
server {
listen 443 ssl;
rewrite_by_lua_block {
local user_agent = ngx.req.get_headers()["user-agent"]
ngx.log(ngx.ERR, "rewrite_by_lua_block user_agent -- > ", user_agent)
}
ssl_client_hello_by_lua_block {
ngx.log(ngx.ERR, "I am from ssl_client_hello_by_lua_block")
local ssl_clt = require "ngx.ssl.clienthello"
local host, err = ssl_clt.get_client_hello_server_name()
ngx.log(ngx.ERR, "hosts -- > ", host)
-- local user_agent = ngx.req.get_headers()["user-agent"]
-- ngx.log(ngx.ERR, "user_agent -- > ", user_agent)
}
ssl_certificate_by_lua_block {
auto_ssl:ssl_certificate()
}
ssl_certificate /etc/ssl/resty-auto-ssl-fallback.crt;
ssl_certificate_key /etc/ssl/resty-auto-ssl-fallback.key;
location / {
proxy_pass http://backend_proxy$request_uri;
}
}
发布于 2022-06-15 08:52:15
如果有人面临同样的问题。这里是OpenResty的电子邮件组,它帮助了我。
我想得不对。证书协商发生在客户端发送用户代理数据之前(在SYNACK到达客户端之后)。因此,您不能保存在此过程中颁发证书。运气不好。
一旦handshake
和Client/Server Hello
发生,那么服务器就有了user-agent
,您就可以在access_by_lua_block
下执行阻塞了。
https://stackoverflow.com/questions/72600559
复制相似问题