Ensure the hook secret can't get removed from memory.

If the shared dict ran out of memory, then the hook secret could end up
getting removed, leading to errors like this:
#48 (comment)

By storing the hook secret as a global variable, it should not longer be
subject to getting removed from the shared dict.

Author: GUI

.luacheckrc

@@ -1,4 +1,5 @@
 globals = {
+  "AUTO_SSL_HOOK_SECRET",
   "ngx",
 }
 

lib/resty/auto-ssl/init_master.lua

@@ -30,7 +30,7 @@ end
 local function generate_hook_sever_secret()
   -- Generate the secret token.
   local random = resty_random.bytes(32)
-  ngx.shared.auto_ssl:set("hook_server:secret", str.to_hex(random))
+  AUTO_SSL_HOOK_SECRET = str.to_hex(random)
 end
 
 local function generate_config(auto_ssl_instance)

lib/resty/auto-ssl/servers/hook.lua

@@ -8,7 +8,7 @@ return function(auto_ssl_instance)
   local path = ngx.var.request_uri
   local params = ngx.req.get_post_args()
 
-  if ngx.var.http_x_hook_secret ~= ngx.shared.auto_ssl:get("hook_server:secret") then
+  if ngx.var.http_x_hook_secret ~= AUTO_SSL_HOOK_SECRET then
     return ngx.exit(ngx.HTTP_FORBIDDEN)
   end
 

lib/resty/auto-ssl/ssl_certificate.lua

@@ -21,12 +21,12 @@ local function convert_to_der_and_cache(domain, fullchain_pem, privkey_pem, newl
   -- across multiple servers).
   local _, set_fullchain_err = ngx.shared.auto_ssl:set("domain:fullchain_der:" .. domain, fullchain_der, 3600)
   if set_fullchain_err then
-    ngx.log(ngx.ERR, "auto-ssl: failed to set shdict cache of certificate chain for " .. domain, set_fullchain_err)
+    ngx.log(ngx.ERR, "auto-ssl: failed to set shdict cache of certificate chain for " .. domain .. ": ", set_fullchain_err)
   end
 
   local _, set_privkey_err = ngx.shared.auto_ssl:set("domain:privkey_der:" .. domain, privkey_der, 3600)
   if set_privkey_err then
-    ngx.log(ngx.ERR, "auto-ssl: failed to set shdict cache of private key for " .. domain, set_privkey_err)
+    ngx.log(ngx.ERR, "auto-ssl: failed to set shdict cache of private key for " .. domain .. ": ", set_privkey_err)
   end
 
   return fullchain_der, privkey_der, newly_issued
@@ -184,7 +184,10 @@ local function set_ocsp_stapling(domain, fullchain_der, newly_issued)
 
     -- Cache the OCSP stapling response for 1 hour (this is what nginx does by
     -- default).
-    ngx.shared.auto_ssl:set("domain:ocsp:" .. domain, ocsp_resp, 3600)
+    local _, set_ocsp_err = ngx.shared.auto_ssl:set("domain:ocsp:" .. domain, ocsp_resp, 3600)
+    if set_ocsp_err then
+      ngx.log(ngx.ERR, "auto-ssl: failed to set shdict cache of OCSP response for " .. domain .. ": ", set_ocsp_err)
+    end
   end
 
   -- Set the OCSP stapling response.

lib/resty/auto-ssl/ssl_providers/lets_encrypt.lua

@@ -15,7 +15,7 @@ function _M.issue_cert(auto_ssl_instance, domain)
   assert(type(hook_port) == "number", "hook_port must be a number")
   assert(hook_port <= 65535, "hook_port must be below 65536")
 
-  local hook_secret = ngx.shared.auto_ssl:get("hook_server:secret")
+  local hook_secret = AUTO_SSL_HOOK_SECRET
   assert(type(hook_secret) == "string", "hook_server:secret must be a string")
 
   local env_vars =

lib/resty/auto-ssl/utils/start_sockproc.lua

@@ -5,7 +5,10 @@ local function start()
   local exit_status = os.execute("umask 0022 && " .. auto_ssl.lua_root .. "/bin/resty-auto-ssl/start_sockproc")
   -- Lua 5.2+ returns boolean. Prior versions return status code.
   if exit_status == 0 or exit_status == true then
-    ngx.shared.auto_ssl:set("sockproc_started", true)
+    local _, set_err = ngx.shared.auto_ssl:set("sockproc_started", true)
+    if set_err then
+      ngx.log(ngx.ERR, "auto-ssl: failed to set shdict for sockproc_started: ", set_err)
+    end
   else
     ngx.log(ngx.ERR, "auto-ssl: failed to start sockproc")
   end

t/multiple_workers.t

@@ -95,9 +95,7 @@ $TEST_NGINX_USER
       -- Since repeat_each is being used, clear the cached information across
       -- test runs so we try to issue a new cert each time.
       ngx.log(ngx.DEBUG, "auto-ssl: delete: domain:fullchain_der:" .. host)
-      ngx.shared.auto_ssl:delete("domain:fullchain_der:" .. host)
-      ngx.shared.auto_ssl:delete("domain:privkey_der:" .. host)
-      ngx.shared.auto_ssl:delete("domain:ocsp:" .. host)
+      ngx.shared.auto_ssl:flush_all()
       ngx.shared.test_counts:flush_all()
       os.execute("rm -rf $TEST_NGINX_RESTY_AUTO_SSL_DIR/storage/file/*")