apply the comments

Author: catbro666

lib/resty/http_connect.lua

@@ -9,6 +9,14 @@ local to_hex = require("resty.string").to_hex
 local ffi_gc = ffi.gc
 local ffi_cast = ffi.cast
 local string_format = string.format
+local type = type
+
+local function require_openssl_libs()
+    local chain = require("resty.openssl.x509.chain")
+    local x509 = require("resty.openssl.x509")
+    local pkey = require("resty.openssl.pkey")
+    return { chain, x509, pkey }
+end
 
 --[[
 A connection function that incorporates:
@@ -174,79 +182,76 @@ local function connect(self, options)
             local key_type = type(ssl_client_priv_key)
 
             if cert_type ~= "cdata" then
-                ngx_log(ngx_WARN, "bad ssl_client_cert: cdata expected, got " .. cert_type)
+                ngx_log(ngx_WARN, "bad ssl_client_cert: cdata expected, got ", cert_type)
                 break
             end
 
             if key_type ~= "cdata" then
-                ngx_log(ngx_WARN, "bad ssl_client_priv_key: cdata expected, got " .. key_type)
+                ngx_log(ngx_WARN, "bad ssl_client_priv_key: cdata expected, got ", key_type)
                 break
             end
 
-            local status, res = xpcall(function()
-                local chain = require("resty.openssl.x509.chain")
-                local x509 = require("resty.openssl.x509")
-                local pkey = require("resty.openssl.pkey")
-                return { chain, x509, pkey }
-            end, debug.traceback)
-
-            if status then
-                local chain = res[1]
-                local x509 = res[2]
-                local pkey = res[3]
-
-                -- convert from `void*` to `OPENSSL_STACK*`
-                local cert_chain, err = chain.dup(ffi_cast("OPENSSL_STACK*", ssl_client_cert))
-                if not cert_chain then
-                    ngx_log(ngx_WARN, "failed to dup the ssl_client_cert, falling back to non-mTLS: " .. err)
-                    break
-                end
+            local status, res = xpcall(require_openssl_libs, debug.traceback)
 
-                if #cert_chain < 1 then
-                    ngx_log(ngx_WARN, "no cert in ssl_client_cert, falling back to non-mTLS: " .. err)
-                    break
-                end
+            if not status then
+                if type(res) == "string" and ngx_re_find(res, "module 'resty\\.openssl\\..+' not found") then
+                    ngx_log(ngx_WARN, "can't use mTLS without module `lua-resty-openssl`, falling back to non-mTLS:\n "
+                                    , res)
 
-                local cert, err = x509.dup(cert_chain[1].ctx)
-                if not cert then
-                    ngx_log(ngx_WARN, "failed to dup the x509, falling back to non-mTLS: " .. err)
-                    break
+                else
+                    ngx_log(ngx_WARN, "failed to load module `resty.openssl.*`, falling back to non-mTLS:\n", res)
                 end
 
-                -- convert from `void*` to `EVP_PKEY*`
-                local key, err = pkey.new(ffi_cast("EVP_PKEY*", ssl_client_priv_key))
-                if not key then
-                    ngx_log(ngx_WARN, "failed to new the pkey, falling back to non-mTLS: " .. err)
-                    break
-                end
-                -- should not free the cdata passed in
-                ffi_gc(key.ctx, nil)
+                break
+            end
 
-                -- check the private key in order to make sure the caller is indeed the holder of the cert
-                ok, err = cert:check_private_key(key)
-                if not ok then
-                    ngx_log(ngx_WARN, "the private key doesn't match the cert, falling back to non-mTLS: " .. err)
-                    break
-                end
+            local chain = res[1]
+            local x509 = res[2]
+            local pkey = res[3]
 
-                cert_hash, err = cert:digest("sha256")
-                if cert_hash then
-                    cert_hash = to_hex(cert_hash) -- convert to hex so that it's printable
+            -- convert from `void*` to `OPENSSL_STACK*`
+            local cert_chain, err = chain.dup(ffi_cast("OPENSSL_STACK*", ssl_client_cert))
+            if not cert_chain then
+                ngx_log(ngx_WARN, "failed to dup the ssl_client_cert, falling back to non-mTLS: ", err)
+                break
+            end
 
-                else
-                    ngx_log(ngx_WARN, "failed to calculate the digest of the cert, falling back to non-mTLS: " .. err)
-                    break
-                end
+            if #cert_chain < 1 then
+                ngx_log(ngx_WARN, "no cert in ssl_client_cert, falling back to non-mTLS: ", err)
+                break
+            end
 
-            else
-                if type(res) == "string" and ngx_re_find(res, "module 'resty\\.openssl\\..+' not found") then
-                    ngx_log(ngx_WARN, "can't use mTLS without module `lua-resty-openssl`, falling back to non-mTLS:\n "
-                                      .. res)
+            local cert, err = x509.dup(cert_chain[1].ctx)
+            if not cert then
+                ngx_log(ngx_WARN, "failed to dup the x509, falling back to non-mTLS: ", err)
+                break
+            end
 
-                else
-                    ngx_log(ngx_WARN, "failed to load module `resty.openssl.*`, falling back to non-mTLS:\n" .. res)
-                end
+            -- convert from `void*` to `EVP_PKEY*`
+            local key, err = pkey.new(ffi_cast("EVP_PKEY*", ssl_client_priv_key))
+            if not key then
+                ngx_log(ngx_WARN, "failed to new the pkey, falling back to non-mTLS: ", err)
+                break
             end
+            -- should not free the cdata passed in
+            ffi_gc(key.ctx, nil)
+
+            -- check the private key in order to make sure the caller is indeed the holder of the cert
+            ok, err = cert:check_private_key(key)
+            if not ok then
+                ngx_log(ngx_WARN, "the private key doesn't match the cert, falling back to non-mTLS: ", err)
+                break
+            end
+
+            cert_hash, err = cert:digest("sha256")
+            if cert_hash then
+                cert_hash = to_hex(cert_hash) -- convert to hex so that it's printable
+
+            else
+                ngx_log(ngx_WARN, "failed to calculate the digest of the cert, falling back to non-mTLS: ", err)
+                break
+            end
+
         until true
     end
 
@@ -273,7 +278,7 @@ local function connect(self, options)
         -- with a plain http request the authorization is part of the actual request.
     end
 
-    ngx_log(ngx_DEBUG, "poolname: " .. poolname)
+    ngx_log(ngx_DEBUG, "poolname: ", poolname)
 
     -- do TCP level connection
     local tcp_opts = { pool = poolname, pool_size = pool_size, backlog = backlog }