Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Migrate scripts from OpenResty to NJS #12403

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
+22 −4
Draft

Migrate scripts from OpenResty to NJS #12403

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ceabf5b
Add NJS module to Nginx
elizabeth-dev Nov 23, 2024
8ed9770
Replace auth cache key generation Lua impl with NJS impl
elizabeth-dev Nov 23, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions images/nginx/rootfs/build.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -106,6 +106,9 @@ export OPENTELEMETRY_CPP_VERSION="v1.11.0"
# Check on https://github.com/open-telemetry/opentelemetry-proto
export OPENTELEMETRY_PROTO_VERSION="v1.1.0"

# Check for recent changes: https://github.com/nginx/njs/compare/0.8.7...master
export NJS_VERSION="0.8.7"

export BUILD_PATH=/tmp/build

ARCH=$(uname -m)
Expand Down Expand Up @@ -414,6 +417,12 @@ Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-980-CORRELATION.conf
Include /etc/nginx/owasp-modsecurity-crs/rules/RESPONSE-999-EXCLUSION-RULES-AFTER-CRS.conf
" > /etc/nginx/owasp-modsecurity-crs/nginx-modsecurity.conf

# checkout njs module
cd "$BUILD_PATH"
git clone -n https://github.com/nginx/njs
cd njs/
git checkout $NJS_VERSION

# build nginx
cd "$BUILD_PATH/nginx-$NGINX_VERSION"

Expand Down Expand Up @@ -478,6 +487,7 @@ WITH_MODULES=" \
--add-module=$BUILD_PATH/lua-nginx-module \
--add-module=$BUILD_PATH/stream-lua-nginx-module \
--add-module=$BUILD_PATH/lua-upstream-nginx-module \
--add-module=$BUILD_PATH/njs/nginx \
--add-dynamic-module=$BUILD_PATH/nginx-http-auth-digest \
--add-dynamic-module=$BUILD_PATH/ModSecurity-nginx \
--add-dynamic-module=$BUILD_PATH/ngx_http_geoip2_module \
Expand Down
7 changes: 7 additions & 0 deletions rootfs/etc/nginx/js/nginx/ngx_conf_rewrite_auth.js
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
const crypto = require('crypto');

function cache_key(req) {
return crypto.createHash('sha1').update(req.variables.tmp_cache_key).digest('base64');
}

export default { cache_key };
9 changes: 5 additions & 4 deletions rootfs/etc/nginx/template/nginx.tmpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,10 @@ http {

init_worker_by_lua_file /etc/nginx/lua/ngx_conf_init_worker.lua;

js_import /etc/nginx/js/nginx/ngx_conf_rewrite_auth.js;

js_set $njs_cache_key ngx_conf_rewrite_auth.cache_key;

{{/* Enable the real_ip module only if we use either X-Forwarded headers or Proxy Protocol. */}}
{{/* we use the value of the real IP for the geo_ip module */}}
{{ if or (or $cfg.UseForwardedHeaders $cfg.UseProxyProtocol) $cfg.EnableRealIP }}
Expand Down Expand Up @@ -988,17 +992,14 @@ stream {

{{ if $externalAuth.AuthCacheKey }}
set $tmp_cache_key '{{ $server.Hostname }}{{ $authPath }}{{ $externalAuth.AuthCacheKey }}';
set $cache_key '';

rewrite_by_lua_file /etc/nginx/lua/nginx/ngx_conf_rewrite_auth.lua;

proxy_cache auth_cache;

{{- range $dur := $externalAuth.AuthCacheDuration }}
proxy_cache_valid {{ $dur }};
{{- end }}

proxy_cache_key "$cache_key";
proxy_cache_key "$njs_cache_key";
{{ end }}

# ngx_auth_request module overrides variables in the parent request,
Expand Down
Loading