feature: implemented ssl_session_fetch_by_lua* and ssl_session_store_by_lua*

[agentzh]

These directives can be used to implement (distributed) caching of SSL sessions (via SSL session IDs) for downstream connections.

The Lua API for manipulating SSL sessions in these two running contexts is provided in the following PR for lua-resty-core:

openresty/lua-resty-core#53

Dependencies:

• NGINX core patch:

--- nginx-1.11.2/src/event/ngx_event_openssl.c  2016-07-05 08:56:15.000000000 -0700
+++ nginx-1.11.2-patched/src/event/ngx_event_openssl.c  2016-07-19 16:46:06.218017083 -0700
@@ -1306,6 +1306,25 @@ ngx_ssl_handshake(ngx_connection_t *c)
         return NGX_AGAIN;
     }

+#if OPENSSL_VERSION_NUMBER >= 0x10002000L
+    if (sslerr == SSL_ERROR_WANT_X509_LOOKUP
+        || sslerr == SSL_ERROR_PENDING_SESSION)
+    {
+        c->read->handler = ngx_ssl_handshake_handler;
+        c->write->handler = ngx_ssl_handshake_handler;
+
+        if (ngx_handle_read_event(c->read, 0) != NGX_OK) {
+            return NGX_ERROR;
+        }
+
+        if (ngx_handle_write_event(c->write, 0) != NGX_OK) {
+            return NGX_ERROR;
+        }
+
+        return NGX_AGAIN;
+    }
+#endif
+
     err = (sslerr == SSL_ERROR_SYSCALL) ? ngx_errno : 0;

     c->ssl->no_wait_shutdown = 1;

The patch can also be applied cleanly to a little older versions of NGINX cores like 1.9.15.

If a recent version of OpenResty is used, like 1.9.15.1, then the following patch should be applied to OpenResty's bundled version of the NGINX core instead:

https://github.com/openresty/openresty/blob/master/patches/nginx-1.11.2-ssl_pending_session.patch

• OpenSSL patch:

https://github.com/openresty/openresty/blob/master/patches/openssl-1.0.2h-sess_set_get_cb_yield.patch

This is for the latest OpenSSL 1.0.2h version. Earlier verisons like 1.0.2e might also work, but the latest version of OpenSSL is strongly encouraged.

Special thanks go to Zi Lin for contributing this new feature and also to CloudFlare for supporting this work.

[agentzh]

@ghedo @lziest @doujiang24 @yangshuxin Please review this PR. Thanks!

[doujiang24]

@agentzh coroutine.create can not be used in ssl_session_fetch_by_lua and ssl_session_store_by_lua now.
Because it will failed in ngx_http_lua_check_context: https://github.com/openresty/lua-nginx-module/blob/master/src/ngx_http_lua_coroutine.c#L76
I think we can let coroutine.create used in ssl_session_fetch_by_lua by change the context check.

[agentzh]

@doujiang24 Fixed. Thanks!

[agentzh]

This PR has just been merged. New issues found should be reported as separate GitHub issues. Thanks!