Open strongjz opened 1 month ago
@strongjz I don't have the ENV to test ocsp.
Would you please test the following patch?
diff --git a/src/ngx_http_lua_ssl_ocsp.c b/src/ngx_http_lua_ssl_ocsp.c
index c9f24cd2..73e1b9c7 100644
--- a/src/ngx_http_lua_ssl_ocsp.c
+++ b/src/ngx_http_lua_ssl_ocsp.c
@@ -280,7 +280,7 @@ ngx_http_lua_ffi_ssl_validate_ocsp_response(const u_char *resp,
OCSP_RESPONSE *ocsp = NULL;
OCSP_BASICRESP *basic = NULL;
STACK_OF(X509) *chain = NULL;
- ASN1_GENERALIZEDTIME *thisupdate, *nextupdate;
+ ASN1_GENERALIZEDTIME *thisupdate = NULL, *nextupdate = NULL;
ocsp = d2i_OCSP_RESPONSE(NULL, &resp, resp_len);
if (ocsp == NULL) {
Would you please start the nginx with valgrind if the above patch does not work?
@strongjz any progress on this issue?
Ingress-nginx updated the lua-nginx-module to version
b5d1688ae722538ba4dc8a7ec08820a08abfb93d
and started seeing core dumps only when OCSP is enabled.nginx version: 1.25.5 lua jit: v2.1-20240314 lua Resty Core: v0.1.28 Alpine: 3.20.0
All versions of modules running: https://github.com/kubernetes/ingress-nginx/blob/release-1.11/images/nginx-1.25/rootfs/build.sh
We reverted to it to known good version v0.10.26 and the core dump issues with OCSP went away.
To reproduce, run ingress-nginx version 1.11.0 with
enable-ocsp: true
https://kubernetes.github.io/ingress-nginx/user-guide/nginx-configuration/configmap/#enable-ocsp and test it with a cert manager and an HTTPS enabled ingress.Core Dumps
Please see https://github.com/kubernetes/ingress-nginx/issues/11588 for more information.
Core dumps are available at