check the private key in order to make sure the caller is indeed the holder of the cert

Author: catbro666

lib/resty/http_connect.lua

@@ -167,18 +167,34 @@ local function connect(self, options)
     local cert_hash
     if ssl and ssl_client_cert and ssl_client_priv_key then
         local status, res = xpcall(function()
-            return require("resty.openssl.x509")
+            local x509 = require("resty.openssl.x509")
+            local pkey = require("resty.openssl.pkey")
+            return { x509, pkey }
         end, debug.traceback)
 
         if status then
-            local x509 = res
+            local x509 = res[1]
+            local pkey = res[2]
             local cert, err = x509.new(ssl_client_cert)
             if not cert then
               return nil, err
             end
             -- should not free the cdata passed in
             ffi_gc(cert.ctx, nil)
 
+            local key, err = pkey.new(ssl_client_priv_key)
+            if not key then
+              return nil, err
+            end
+            -- should not free the cdata passed in
+            ffi_gc(key.ctx, nil)
+
+            -- check the private key in order to make sure the caller is indeed the holder of the cert
+            ok, err = cert:check_private_key(key)
+            if not ok then
+              return nil, "failed to match the private key with the certificate: " .. err
+            end
+
             cert_hash, err = cert:digest("sha256")
             if cert_hash then
               cert_hash = to_hex(cert_hash) -- convert to hex so that it's printable
@@ -188,11 +204,11 @@ local function connect(self, options)
             end
 
         else
-            if type(res) == "string" and ngx_re_find(res, "module 'resty\\.openssl\\.x509)' not found") then
+            if type(res) == "string" and ngx_re_find(res, "module 'resty\\.openssl\\.(x509|pkey)' not found") then
                 ngx_log(ngx_WARN, "can't use mTLS without module `lua-resty-openssl`, falling back to non-mTLS.")
 
             else
-                return nil, "failed to load module 'resty.openssl.x509':\n" .. res
+                return nil, "failed to load module 'resty.openssl.*':\n" .. res
             end
         end
     end