feat: upgrade to openresty-1.25.3.1

.github/workflows/ci.yml

@@ -13,6 +13,7 @@ jobs:
         op_version:
           - "1.21.4.1"
           - "1.21.4.2"
+          - "1.25.3.1"
 
     runs-on: "ubuntu-20.04"
 
@@ -39,7 +40,7 @@ jobs:
 
       - name: Install
         run: |
-          wget https://raw.githubusercontent.com/api7/apisix-build-tools/master/build-apisix-base.sh
+          wget https://raw.githubusercontent.com/zll600/apisix-build-tools/upgrade_openresty-1.25.3.1/build-apisix-runtime.sh
           chmod +x build-apisix-base.sh
           OR_PREFIX=$OPENRESTY_PREFIX CC="clang -fsanitize=address -fcolor-diagnostics -Qunused-arguments" \
               cc_opt="-Werror" ./build-apisix-base.sh latest

patch/1.25.3.1/lua-resty-core-bugfix-Apple-Silicon-FFI-ABI-limitation-workaround.patch

@@ -0,0 +1,90 @@
+diff --git lib/resty/core/response.lua lib/resty/core/response.lua
+index 891a07e..986de74 100644
+--- lib/resty/core/response.lua
++++ lib/resty/core/response.lua
+@@ -45,6 +45,61 @@ ffi.cdef[[
+ ]]
+
+
++local ngx_lua_ffi_set_resp_header
++
++local MACOS = jit and jit.os == "OSX"
++
++if MACOS then
++    ffi.cdef[[
++        typedef struct {
++            ngx_http_request_t   *r;
++            const char           *key_data;
++            size_t                key_len;
++            int                   is_nil;
++            const char           *sval;
++            size_t                sval_len;
++            void                 *mvals;
++            size_t                mvals_len;
++            int                   override;
++            char                **errmsg;
++        } ngx_http_lua_set_resp_header_params_t;
++
++        int ngx_http_lua_ffi_set_resp_header_macos(
++            ngx_http_lua_set_resp_header_params_t *p);
++    ]]
++
++    local set_params = ffi.new("ngx_http_lua_set_resp_header_params_t")
++
++    ngx_lua_ffi_set_resp_header = function(r, key, key_len, is_nil,
++                                           sval, sval_len, mvals,
++                                           mvals_len, override, err)
++
++        set_params.r = r
++        set_params.key_data = key
++        set_params.key_len = key_len
++        set_params.is_nil = is_nil
++        set_params.sval = sval
++        set_params.sval_len = sval_len
++        set_params.mvals = mvals
++        set_params.mvals_len = mvals_len
++        set_params.override = override
++        set_params.errmsg = err
++
++        return C.ngx_http_lua_ffi_set_resp_header_macos(set_params)
++    end
++
++else
++    ngx_lua_ffi_set_resp_header = function(r, key, key_len, is_nil,
++                                           sval, sval_len, mvals,
++                                           mvals_len, override, err)
++
++        return C.ngx_http_lua_ffi_set_resp_header(r, key, key_len, is_nil,
++                                                  sval, sval_len, mvals,
++                                                  mvals_len, override, err)
++    end
++end
++
++
+ local function set_resp_header(tb, key, value, no_override)
+     local r = get_request()
+     if not r then
+@@ -61,8 +116,8 @@ local function set_resp_header(tb, key, value, no_override)
+             error("invalid header value", 3)
+         end
+
+-        rc = C.ngx_http_lua_ffi_set_resp_header(r, key, #key, true, nil, 0, nil,
+-                                                0, 1, errmsg)
++        rc = ngx_lua_ffi_set_resp_header(r, key, #key, true, nil, 0, nil,
++                                         0, 1, errmsg)
+     else
+         local sval, sval_len, mvals, mvals_len, buf
+
+@@ -99,9 +154,9 @@ local function set_resp_header(tb, key, value, no_override)
+         end
+
+         local override_int = no_override and 0 or 1
+-        rc = C.ngx_http_lua_ffi_set_resp_header(r, key, #key, false, sval,
+-                                                sval_len, mvals, mvals_len,
+-                                                override_int, errmsg)
++        rc = ngx_lua_ffi_set_resp_header(r, key, #key, false, sval,
++                                         sval_len, mvals, mvals_len,
++                                         override_int, errmsg)
+     end
+
+     if rc == 0 or rc == FFI_DECLINED then

patch/1.25.3.1/lua-resty-core-enable_keepalive.patch

@@ -0,0 +1,219 @@
+diff --git lib/ngx/balancer.lua lib/ngx/balancer.lua
+index 7d64d63..781cbd1 100644
+--- lib/ngx/balancer.lua
++++ lib/ngx/balancer.lua
+@@ -3,6 +3,7 @@
+
+ local base = require "resty.core.base"
+ base.allows_subsystem('http', 'stream')
++require "resty.core.hash"
+
+
+ local ffi = require "ffi"
+@@ -17,8 +18,10 @@ local error = error
+ local type = type
+ local tonumber = tonumber
+ local max = math.max
++local ngx_crc32_long = ngx.crc32_long
+ local subsystem = ngx.config.subsystem
+ local ngx_lua_ffi_balancer_set_current_peer
++local ngx_lua_ffi_balancer_enable_keepalive
+ local ngx_lua_ffi_balancer_set_more_tries
+ local ngx_lua_ffi_balancer_get_last_failure
+ local ngx_lua_ffi_balancer_set_timeouts -- used by both stream and http
+@@ -27,7 +30,11 @@ local ngx_lua_ffi_balancer_set_timeouts -- used by both stream and http
+ if subsystem == 'http' then
+     ffi.cdef[[
+     int ngx_http_lua_ffi_balancer_set_current_peer(ngx_http_request_t *r,
+-        const unsigned char *addr, size_t addr_len, int port, char **err);
++        const unsigned char *addr, size_t addr_len, int port,
++        unsigned int cpool_crc32, unsigned int cpool_size, char **err);
++
++    int ngx_http_lua_ffi_balancer_enable_keepalive(ngx_http_request_t *r,
++        unsigned long timeout, unsigned int max_requests, char **err);
+
+     int ngx_http_lua_ffi_balancer_set_more_tries(ngx_http_request_t *r,
+         int count, char **err);
+@@ -46,6 +53,9 @@ if subsystem == 'http' then
+     ngx_lua_ffi_balancer_set_current_peer =
+         C.ngx_http_lua_ffi_balancer_set_current_peer
+
++    ngx_lua_ffi_balancer_enable_keepalive =
++        C.ngx_http_lua_ffi_balancer_enable_keepalive
++
+     ngx_lua_ffi_balancer_set_more_tries =
+         C.ngx_http_lua_ffi_balancer_set_more_tries
+
+@@ -96,6 +106,11 @@ else
+ end
+
+
++local DEFAULT_KEEPALIVE_POOL_SIZE = 30
++local DEFAULT_KEEPALIVE_IDLE_TIMEOUT = 60000
++local DEFAULT_KEEPALIVE_MAX_REQUESTS = 100
++
++
+ local peer_state_names = {
+     [1] = "keepalive",
+     [2] = "next",
+@@ -106,25 +121,147 @@ local peer_state_names = {
+ local _M = { version = base.version }
+
+
+-function _M.set_current_peer(addr, port)
+-    local r = get_request()
+-    if not r then
+-        error("no request found")
++if subsystem == "http" then
++    function _M.set_current_peer(addr, port, opts)
++        local r = get_request()
++        if not r then
++            error("no request found")
++        end
++
++        local pool_crc32
++        local pool_size
++
++        if opts then
++            if type(opts) ~= "table" then
++                error("bad argument #3 to 'set_current_peer' " ..
++                      "(table expected, got " .. type(opts) .. ")", 2)
++            end
++
++            local pool = opts.pool
++            pool_size = opts.pool_size
++
++            if pool then
++                if type(pool) ~= "string" then
++                    error("bad option 'pool' to 'set_current_peer' " ..
++                          "(string expected, got " .. type(pool) .. ")", 2)
++                end
++
++                pool_crc32 = ngx_crc32_long(pool)
++            end
++
++            if pool_size then
++                if type(pool_size) ~= "number" then
++                    error("bad option 'pool_size' to 'set_current_peer' " ..
++                          "(number expected, got " .. type(pool_size) .. ")", 2)
++
++                elseif pool_size < 1 then
++                    error("bad option 'pool_size' to 'set_current_peer' " ..
++                          "(expected > 0)", 2)
++                end
++            end
++        end
++
++        if not port then
++            port = 0
++
++        elseif type(port) ~= "number" then
++            port = tonumber(port)
++        end
++
++        if not pool_crc32 then
++            pool_crc32 = 0
++        end
++
++        if not pool_size then
++            pool_size = DEFAULT_KEEPALIVE_POOL_SIZE
++        end
++
++        local rc = ngx_lua_ffi_balancer_set_current_peer(r, addr, #addr, port,
++                                                         pool_crc32, pool_size,
++                                                         errmsg)
++        if rc == FFI_OK then
++            return true
++        end
++
++        return nil, ffi_str(errmsg[0])
+     end
+
+-    if not port then
+-        port = 0
+-    elseif type(port) ~= "number" then
+-        port = tonumber(port)
++else
++    function _M.set_current_peer(addr, port, opts)
++        local r = get_request()
++        if not r then
++            error("no request found")
++        end
++
++        if opts then
++            error("bad argument #3 to 'set_current_peer' ('opts' not yet " ..
++                  "implemented in " .. subsystem .. " subsystem)", 2)
++        end
++
++        if not port then
++            port = 0
++
++        elseif type(port) ~= "number" then
++            port = tonumber(port)
++        end
++
++        local rc = ngx_lua_ffi_balancer_set_current_peer(r, addr, #addr,
++                                                         port, errmsg)
++        if rc == FFI_OK then
++            return true
++        end
++
++        return nil, ffi_str(errmsg[0])
+     end
++end
+
+-    local rc = ngx_lua_ffi_balancer_set_current_peer(r, addr, #addr,
+-                                                     port, errmsg)
+-    if rc == FFI_OK then
+-        return true
++
++if subsystem == "http" then
++    function _M.enable_keepalive(idle_timeout, max_requests)
++        local r = get_request()
++        if not r then
++            error("no request found")
++        end
++
++        if not idle_timeout then
++            idle_timeout = DEFAULT_KEEPALIVE_IDLE_TIMEOUT
++
++        elseif type(idle_timeout) ~= "number" then
++            error("bad argument #1 to 'enable_keepalive' " ..
++                  "(number expected, got " .. type(idle_timeout) .. ")", 2)
++
++        elseif idle_timeout < 0 then
++            error("bad argument #1 to 'enable_keepalive' (expected >= 0)", 2)
++
++        else
++            idle_timeout = idle_timeout * 1000
++        end
++
++        if not max_requests then
++            max_requests = DEFAULT_KEEPALIVE_MAX_REQUESTS
++
++        elseif type(max_requests) ~= "number" then
++            error("bad argument #2 to 'enable_keepalive' " ..
++                  "(number expected, got " .. type(max_requests) .. ")", 2)
++
++        elseif max_requests < 0 then
++            error("bad argument #2 to 'enable_keepalive' (expected >= 0)", 2)
++        end
++
++        local rc = ngx_lua_ffi_balancer_enable_keepalive(r, idle_timeout,
++                                                         max_requests, errmsg)
++        if rc == FFI_OK then
++            return true
++        end
++
++        return nil, ffi_str(errmsg[0])
+     end
+
+-    return nil, ffi_str(errmsg[0])
++else
++    function _M.enable_keepalive()
++        error("'enable_keepalive' not yet implemented in " .. subsystem ..
++              " subsystem", 2)
++    end
+ end
+
+

patch/1.25.3.1/lua-resty-core-reject-in-handshake.patch

@@ -0,0 +1,48 @@
+diff --git lib/ngx/ssl.lua lib/ngx/ssl.lua
+index 8792be0..c4afc80 100644
+--- lib/ngx/ssl.lua
++++ lib/ngx/ssl.lua
+@@ -86,7 +86,7 @@ if subsystem == 'http' then
+     void ngx_http_lua_ffi_free_priv_key(void *cdata);
+
+     int ngx_http_lua_ffi_ssl_verify_client(void *r,
+-        void *cdata, int depth, char **err);
++        void *cdata, int depth, int reject_in_handshake, char **err);
+     ]]
+
+     ngx_lua_ffi_ssl_set_der_certificate =
+@@ -157,7 +157,7 @@ elseif subsystem == 'stream' then
+     void ngx_stream_lua_ffi_free_priv_key(void *cdata);
+
+     int ngx_stream_lua_ffi_ssl_verify_client(void *r,
+-        void *cdata, int depth, char **err);
++        void *cdata, int depth, int reject_in_handshake, char **err);
+     ]]
+
+     ngx_lua_ffi_ssl_set_der_certificate =
+@@ -417,7 +417,7 @@ function _M.set_priv_key(priv_key)
+ end
+
+
+-function _M.verify_client(ca_certs, depth)
++function _M.verify_client(ca_certs, depth, reject_in_handshake)
+     local r = get_request()
+     if not r then
+         error("no request found")
+@@ -427,7 +427,15 @@ function _M.verify_client(ca_certs, depth)
+         depth = -1
+     end
+
+-    local rc = ngx_lua_ffi_ssl_verify_client(r, ca_certs, depth, errmsg)
++    if reject_in_handshake == nil then
++        -- reject by default so we can migrate to the new behavior
++        -- without modifying Lua code
++        reject_in_handshake = true
++    end
++
++    local reject_in_handshake_int = reject_in_handshake and 1 or 0
++    local rc = ngx_lua_ffi_ssl_verify_client(r, ca_certs, depth,
++                                             reject_in_handshake_int, errmsg)
+     if rc == FFI_OK then
+         return true
+     end