This is an automated email from the ASF dual-hosted git repository.
nic-6443 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/apisix.git
The following commit(s) were added to refs/heads/master by this push:
new 60bb943e20 fix(sls-logger): verify the TLS certificate of the log
server (#13785)
60bb943e20 is described below
commit 60bb943e20cd541e60572931ee960d844e62935d
Author: Nic <[email protected]>
AuthorDate: Fri Aug 7 14:44:08 2026 +0800
fix(sls-logger): verify the TLS certificate of the log server (#13785)
---
apisix/plugins/sls-logger.lua | 5 +++--
docs/en/latest/plugins/sls-logger.md | 1 +
docs/zh/latest/plugins/sls-logger.md | 1 +
t/plugin/sls-logger.t | 20 ++++++++++++++++++++
4 files changed, 25 insertions(+), 2 deletions(-)
diff --git a/apisix/plugins/sls-logger.lua b/apisix/plugins/sls-logger.lua
index 1f0c6280f0..65918f2bd8 100644
--- a/apisix/plugins/sls-logger.lua
+++ b/apisix/plugins/sls-logger.lua
@@ -58,7 +58,8 @@ local schema = {
project = {type = "string"},
logstore = {type = "string"},
access_key_id = {type = "string"},
- access_key_secret = {type ="string"}
+ access_key_secret = {type ="string"},
+ ssl_verify = {type = "boolean", default = true}
},
encrypt_fields = {"access_key_secret"},
required = {"host", "port", "project", "logstore", "access_key_id",
"access_key_secret"}
@@ -108,7 +109,7 @@ local function send_tcp_data(route_conf, log_message)
.. "] port[" .. tostring(route_conf.port) .. "] err: "
.. err
end
- ok, err = sock:sslhandshake(true, nil, false)
+ ok, err = sock:sslhandshake(true, route_conf.host, route_conf.ssl_verify)
if not ok then
return false, "failed to perform TLS handshake to TCP server: host["
.. route_conf.host .. "] port[" ..
tostring(route_conf.port)
diff --git a/docs/en/latest/plugins/sls-logger.md
b/docs/en/latest/plugins/sls-logger.md
index b5d8ab1d44..cd53f5efce 100644
--- a/docs/en/latest/plugins/sls-logger.md
+++ b/docs/en/latest/plugins/sls-logger.md
@@ -46,6 +46,7 @@ It might take some time to receive the log data. It will be
automatically sent a
| logstore | True | logstore name in Ali Cloud log service.
Create SLS before using this Plugin.
|
| access_key_id | True | AccessKey ID in Alibaba Cloud. See
[Authorization](https://www.alibabacloud.com/help/en/log-service/latest/create-a-ram-user-and-authorize-the-ram-user-to-access-log-service)
for more details.
|
| access_key_secret | True | AccessKey Secret in Alibaba Cloud. See
[Authorization](https://www.alibabacloud.com/help/en/log-service/latest/create-a-ram-user-and-authorize-the-ram-user-to-access-log-service)
for more details.
|
+| ssl_verify | False | When set to `true`, verifies the TLS
certificate of the log server. Defaults to `true`.
|
| include_req_body | True | When set to `true`, includes the request body
in the log.
|
| include_req_body_expr | No | Filter for when the `include_req_body`
attribute is set to `true`. Request body is only logged when the expression set
here evaluates to `true`. See
[lua-resty-expr](https://github.com/api7/lua-resty-expr) for more.
|
| max_req_body_bytes | False | Request bodies within this size will be logged,
if the size exceeds the configured value it will be truncated before logging. |
diff --git a/docs/zh/latest/plugins/sls-logger.md
b/docs/zh/latest/plugins/sls-logger.md
index a3374f7ae7..f434a8b97d 100644
--- a/docs/zh/latest/plugins/sls-logger.md
+++ b/docs/zh/latest/plugins/sls-logger.md
@@ -42,6 +42,7 @@ title: sls-logger
| logstore | 必须的 | 日志服务 Logstore 名称，请提前在阿里云日志服务中创建 Logstore。|
| access_key_id | 必须的 | AccessKey ID。建议使用阿里云子账号 AK，详情请参见
[授权](https://help.aliyun.com/document_detail/47664.html?spm=a2c4g.11186623.2.15.49301b47lfvxXP#task-xsk-ttc-ry)。|
| access_key_secret | 必须的 | AccessKey Secret。建议使用阿里云子账号 AK，详情请参见
[授权](https://help.aliyun.com/document_detail/47664.html?spm=a2c4g.11186623.2.15.49301b47lfvxXP#task-xsk-ttc-ry)。|
+| ssl_verify | 否 | 设置为 `true` 时校验日志服务器的 TLS 证书。默认为 `true`。 |
| include_req_body | 可选的 | 是否包含请求体。|
| include_req_body_expr | 可选的 | 当 `include_req_body` 属性设置为 `true`
时的过滤器。只有当此处设置的表达式求值为 `true` 时，才会记录请求体。有关更多信息，请参阅
[lua-resty-expr](https://github.com/api7/lua-resty-expr) 。 |
| include_resp_body | 可选的 | 当设置为 `true` 时，日志中将包含响应体。
|
diff --git a/t/plugin/sls-logger.t b/t/plugin/sls-logger.t
index ce3c7c558a..f5d5d027a8 100644
--- a/t/plugin/sls-logger.t
+++ b/t/plugin/sls-logger.t
@@ -544,3 +544,23 @@ GET /t
--- response_body
done
--- no_error_log
+
+
+
+=== TEST 18: ssl_verify defaults to true
+--- config
+ location /t {
+ content_by_lua_block {
+ local plugin = require("apisix.plugins.sls-logger")
+ local conf = {
+ host = "127.0.0.1", port = 10009,
+ project = "p", logstore = "l",
+ access_key_id = "id", access_key_secret = "sec"
+ }
+ local ok, err = plugin.check_schema(conf)
+ if not ok then ngx.say("check failed: ", err); return end
+ ngx.say("ssl_verify=", tostring(conf.ssl_verify))
+ }
+ }
+--- response_body
+ssl_verify=true
