The sslhandshake function does not handle the scenario where ngx_http_lua_ffi_socket_tcp_sslhandshake directly returns FFI_OK.

[akf00000]

When i test the sslhandshake future，i connect to local machine and i set the ssl_verify future, sometimes it failed in assert check.

log:
/usr/local/openresty/lualib/resty/core/socket.lua:281: assertion failed!

I add some log and found the ngx_http_lua_ffi_socket_tcp_sslhandshake return FFI_OK， when assert failed happen。

I think it should add check FFI_OK:

local rc = C.ngx_http_lua_ffi_socket_tcp_sslhandshake(r, u,
               session_ptr[0],
               reused_session ~= false,
               server_name_str,
               ssl_verify and 1 or 0,
               send_status_req and 1 or 0,
               cosocket[SOCKET_CLIENT_CERT_INDEX],
               cosocket[SOCKET_CLIENT_PKEY_INDEX],
               errmsg)

if rc == FFI_NO_REQ_CTX then
    error("no request ctx found", 2)
end

if rc == FFI_OK then
    if reused_session == false then
        return true
    end

    rc = C.ngx_http_lua_ffi_socket_tcp_get_sslhandshake_result(r, u,
             session_ptr, errmsg, openssl_error_code)
end

[zhuizhuhaomeng]

Have you try this patch ?

[akf00000]

yes, i try this patch, and never assert again when ngx_http_lua_ffi_socket_tcp_sslhandshake return FFI_OK and peer verify failed.

[zhuizhuhaomeng]

Would you please create a PR for this isssue?