apply the comment

Author: catbro666

lib/resty/http_connect.lua

@@ -175,84 +175,86 @@ local function connect(self, options)
     end
 
     local cert_hash
-    if ssl and ssl_client_cert and ssl_client_priv_key then
-        -- fallback to non-mTLS when any error
-        repeat
-            local cert_type = type(ssl_client_cert)
-            local key_type = type(ssl_client_priv_key)
-
-            if cert_type ~= "cdata" then
-                ngx_log(ngx_WARN, "bad ssl_client_cert: cdata expected, got ", cert_type)
-                break
-            end
+    -- fallback to non-mTLS when any error
+    repeat
+        if not ssl or not ssl_client_cert or not ssl_client_priv_key then
+            break
+        end
 
-            if key_type ~= "cdata" then
-                ngx_log(ngx_WARN, "bad ssl_client_priv_key: cdata expected, got ", key_type)
-                break
-            end
+        local cert_type = type(ssl_client_cert)
+        local key_type = type(ssl_client_priv_key)
 
-            local status, res = xpcall(require_openssl_libs, debug.traceback)
+        if cert_type ~= "cdata" then
+            ngx_log(ngx_WARN, "bad ssl_client_cert: cdata expected, got ", cert_type)
+            break
+        end
 
-            if not status then
-                if type(res) == "string" and ngx_re_find(res, "module 'resty\\.openssl\\..+' not found") then
-                    ngx_log(ngx_WARN, "can't use mTLS without module `lua-resty-openssl`, falling back to non-mTLS:\n "
-                                    , res)
+        if key_type ~= "cdata" then
+            ngx_log(ngx_WARN, "bad ssl_client_priv_key: cdata expected, got ", key_type)
+            break
+        end
 
-                else
-                    ngx_log(ngx_WARN, "failed to load module `resty.openssl.*`, falling back to non-mTLS:\n", res)
-                end
+        local status, res = xpcall(require_openssl_libs, debug.traceback)
 
-                break
+        if not status then
+            if type(res) == "string" and ngx_re_find(res, "module 'resty\\.openssl\\..+' not found") then
+                ngx_log(ngx_WARN, "can't use mTLS without module `lua-resty-openssl`, falling back to non-mTLS:\n "
+                                , res)
+
+            else
+                ngx_log(ngx_WARN, "failed to load module `resty.openssl.*`, falling back to non-mTLS:\n", res)
             end
 
-            local chain = res[1]
-            local x509 = res[2]
-            local pkey = res[3]
+            break
+        end
 
-            -- convert from `void*` to `OPENSSL_STACK*`
-            local cert_chain, err = chain.dup(ffi_cast("OPENSSL_STACK*", ssl_client_cert))
-            if not cert_chain then
-                ngx_log(ngx_WARN, "failed to dup the ssl_client_cert, falling back to non-mTLS: ", err)
-                break
-            end
+        local chain = res[1]
+        local x509 = res[2]
+        local pkey = res[3]
 
-            if #cert_chain < 1 then
-                ngx_log(ngx_WARN, "no cert in ssl_client_cert, falling back to non-mTLS: ", err)
-                break
-            end
+        -- convert from `void*` to `OPENSSL_STACK*`
+        local cert_chain, err = chain.dup(ffi_cast("OPENSSL_STACK*", ssl_client_cert))
+        if not cert_chain then
+            ngx_log(ngx_WARN, "failed to dup the ssl_client_cert, falling back to non-mTLS: ", err)
+            break
+        end
 
-            local cert, err = x509.dup(cert_chain[1].ctx)
-            if not cert then
-                ngx_log(ngx_WARN, "failed to dup the x509, falling back to non-mTLS: ", err)
-                break
-            end
+        if #cert_chain < 1 then
+            ngx_log(ngx_WARN, "no cert in ssl_client_cert, falling back to non-mTLS: ", err)
+            break
+        end
 
-            -- convert from `void*` to `EVP_PKEY*`
-            local key, err = pkey.new(ffi_cast("EVP_PKEY*", ssl_client_priv_key))
-            if not key then
-                ngx_log(ngx_WARN, "failed to new the pkey, falling back to non-mTLS: ", err)
-                break
-            end
-            -- should not free the cdata passed in
-            ffi_gc(key.ctx, nil)
+        local cert, err = x509.dup(cert_chain[1].ctx)
+        if not cert then
+            ngx_log(ngx_WARN, "failed to dup the x509, falling back to non-mTLS: ", err)
+            break
+        end
 
-            -- check the private key in order to make sure the caller is indeed the holder of the cert
-            ok, err = cert:check_private_key(key)
-            if not ok then
-                ngx_log(ngx_WARN, "the private key doesn't match the cert, falling back to non-mTLS: ", err)
-                break
-            end
+        -- convert from `void*` to `EVP_PKEY*`
+        local key, err = pkey.new(ffi_cast("EVP_PKEY*", ssl_client_priv_key))
+        if not key then
+            ngx_log(ngx_WARN, "failed to new the pkey, falling back to non-mTLS: ", err)
+            break
+        end
+        -- should not free the cdata passed in
+        ffi_gc(key.ctx, nil)
 
-            cert_hash, err = cert:digest("sha256")
-            if not cert_hash then
-                ngx_log(ngx_WARN, "failed to calculate the digest of the cert, falling back to non-mTLS: ", err)
-                break
-            end
+        -- check the private key in order to make sure the caller is indeed the holder of the cert
+        ok, err = cert:check_private_key(key)
+        if not ok then
+            ngx_log(ngx_WARN, "the private key doesn't match the cert, falling back to non-mTLS: ", err)
+            break
+        end
 
-            cert_hash = to_hex(cert_hash) -- convert to hex so that it's printable
+        cert_hash, err = cert:digest("sha256")
+        if not cert_hash then
+            ngx_log(ngx_WARN, "failed to calculate the digest of the cert, falling back to non-mTLS: ", err)
+            break
+        end
 
-        until true
-    end
+        cert_hash = to_hex(cert_hash) -- convert to hex so that it's printable
+
+    until true
 
     if not cert_hash then
         ssl_client_cert = nil