bhuvan-somisetty opened a new issue, #14056:
URL: https://github.com/apache/apisix/issues/14056
### Current Behavior
In `apisix/init.lua`, the function `verify_https_client(ctx)` is invoked
during the HTTP access phase for any HTTPS request:
```lua
local function verify_https_client(ctx)
local scheme = ctx.var.scheme
if scheme ~= "https" then
return true
end
local matched_ssl = ngx.ctx.matched_ssl
if matched_ssl.value.client
and matched_ssl.value.client.skip_mtls_uri_regex
and apisix_ssl.support_client_verification()
and (not uri_matches_skip_mtls_route_patterns(matched_ssl,
ngx.var.uri)) then
local res = ctx.var.ssl_client_verify
if res ~= "SUCCESS" then
if res == "NONE" then
core.log.error("client certificate was not present")
else
core.log.error("client certificate verification is not
passed: ", res)
end
return false
end
end
local host = ctx.var.host
local matched = router.router_ssl.match_and_set(ctx, true, host)
if not matched then
return true
end
local matched_ssl = ctx.matched_ssl
if matched_ssl.value.client and apisix_ssl.support_client_verification()
then
...
```
At line 460, `local matched_ssl = ngx.ctx.matched_ssl` is read, and line 461
immediately accesses `matched_ssl.value.client` without checking if
`matched_ssl` or `matched_ssl.value` is nil.
When an HTTPS request arrives where:
1. No custom SSL configuration in APISIX matches the request SNI (for
example, hitting an unrecognized hostname or direct IP, or when SSL termination
falls back to native Nginx certificates configured via `ssl_certificate`
directives in `config.yaml` / Nginx template), or
2. The SSL handshake completed without setting `ngx.ctx.matched_ssl`,
`ngx.ctx.matched_ssl` is `nil`.
Because `verify_https_client(ctx)` evaluates `if matched_ssl.value.client
...`, Lua throws a fatal runtime error:
```text
attempt to index local 'matched_ssl' (a nil value)
```
This causes APISIX to immediately fail the request with HTTP 500 Internal
Server Error instead of proceeding with normal fallback handling or subsequent
routing checks.
Note that later in the same function (lines 478-484), the code correctly
checks whether a match was found before accessing `ctx.matched_ssl`:
```lua
local matched = router.router_ssl.match_and_set(ctx, true, host)
if not matched then
return true
end
local matched_ssl = ctx.matched_ssl
if matched_ssl.value.client ...
```
However, the initial check at lines 460-464 is missing nil guards for
`matched_ssl` and `matched_ssl.value`.
### Expected Behavior
`verify_https_client(ctx)` should verify that `matched_ssl` and
`matched_ssl.value` are not nil before accessing `matched_ssl.value.client`:
```lua
local matched_ssl = ngx.ctx.matched_ssl
if matched_ssl and matched_ssl.value and matched_ssl.value.client
and matched_ssl.value.client.skip_mtls_uri_regex
and apisix_ssl.support_client_verification()
and (not uri_matches_skip_mtls_route_patterns(matched_ssl, ngx.var.uri))
then
```
If `ngx.ctx.matched_ssl` is nil, it should safely skip the route-specific
skip-mTLS check and continue to host matching.
### Error Logs
```text
2026/10/20 18:00:00 [error] 12345#12345: *1 lua entry thread aborted:
runtime error: /usr/local/apisix/apisix/init.lua:461: attempt to index local
'matched_ssl' (a nil value)
stack traceback:
coroutine 0:
/usr/local/apisix/apisix/init.lua: in function 'verify_https_client'
/usr/local/apisix/apisix/init.lua: in function 'http_access_phase'
```
### Steps to Reproduce
1. Start APISIX with HTTPS enabled on port 9443 (e.g., using default Nginx
SSL certificates or no SSL objects configured in etcd).
2. Create an HTTP route:
```bash
curl -X PUT http://127.0.0.1:9180/apisix/admin/routes/1 \
-H 'X-API-KEY: edd1c9f034335f136f87ad84b625c8f1' \
-d '{
"uri": "/hello",
"upstream": {
"type": "roundrobin",
"nodes": {"127.0.0.1:1980": 1}
}
}'
```
3. Send an HTTPS request with an SNI or IP that does not match any
configured APISIX SSL object in etcd (e.g., `curl -k
https://127.0.0.1:9443/hello`).
4. `ngx.ctx.matched_ssl` is nil, causing `verify_https_client` to crash with
`attempt to index local 'matched_ssl' (a nil value)`.
### Environment
- APISIX version (run `apisix version`): master (3.19.0)
- Operating system (run `uname -a`): Linux 5.15.0-generic x86_64
- OpenResty / Nginx version (run `openresty -V` or `nginx -V`):
openresty/1.25.3.1
- etcd version, if relevant (run `curl
http://127.0.0.1:9090/v1/server_info`): 3.5.11
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
