bunkerweb 1.4.0

deps/src/lua-resty-core/lib/ngx/balancer.lua

@@ -0,0 +1,234 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http', 'stream')
+
+
+local ffi = require "ffi"
+local C = ffi.C
+local ffi_str = ffi.string
+local errmsg = base.get_errmsg_ptr()
+local FFI_OK = base.FFI_OK
+local FFI_ERROR = base.FFI_ERROR
+local int_out = ffi.new("int[1]")
+local get_request = base.get_request
+local error = error
+local type = type
+local tonumber = tonumber
+local max = math.max
+local subsystem = ngx.config.subsystem
+local ngx_lua_ffi_balancer_set_current_peer
+local ngx_lua_ffi_balancer_set_more_tries
+local ngx_lua_ffi_balancer_get_last_failure
+local ngx_lua_ffi_balancer_set_timeouts -- used by both stream and http
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_balancer_set_current_peer(ngx_http_request_t *r,
+        const unsigned char *addr, size_t addr_len, int port, char **err);
+
+    int ngx_http_lua_ffi_balancer_set_more_tries(ngx_http_request_t *r,
+        int count, char **err);
+
+    int ngx_http_lua_ffi_balancer_get_last_failure(ngx_http_request_t *r,
+        int *status, char **err);
+
+    int ngx_http_lua_ffi_balancer_set_timeouts(ngx_http_request_t *r,
+        long connect_timeout, long send_timeout,
+        long read_timeout, char **err);
+
+    int ngx_http_lua_ffi_balancer_recreate_request(ngx_http_request_t *r,
+        char **err);
+    ]]
+
+    ngx_lua_ffi_balancer_set_current_peer =
+        C.ngx_http_lua_ffi_balancer_set_current_peer
+
+    ngx_lua_ffi_balancer_set_more_tries =
+        C.ngx_http_lua_ffi_balancer_set_more_tries
+
+    ngx_lua_ffi_balancer_get_last_failure =
+        C.ngx_http_lua_ffi_balancer_get_last_failure
+
+    ngx_lua_ffi_balancer_set_timeouts =
+        C.ngx_http_lua_ffi_balancer_set_timeouts
+
+elseif subsystem == 'stream' then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_balancer_set_current_peer(
+        ngx_stream_lua_request_t *r,
+        const unsigned char *addr, size_t addr_len, int port, char **err);
+
+    int ngx_stream_lua_ffi_balancer_set_more_tries(ngx_stream_lua_request_t *r,
+        int count, char **err);
+
+    int ngx_stream_lua_ffi_balancer_get_last_failure(
+        ngx_stream_lua_request_t *r, int *status, char **err);
+
+    int ngx_stream_lua_ffi_balancer_set_timeouts(ngx_stream_lua_request_t *r,
+        long connect_timeout, long timeout, char **err);
+    ]]
+
+    ngx_lua_ffi_balancer_set_current_peer =
+        C.ngx_stream_lua_ffi_balancer_set_current_peer
+
+    ngx_lua_ffi_balancer_set_more_tries =
+        C.ngx_stream_lua_ffi_balancer_set_more_tries
+
+    ngx_lua_ffi_balancer_get_last_failure =
+        C.ngx_stream_lua_ffi_balancer_get_last_failure
+
+    local ngx_stream_lua_ffi_balancer_set_timeouts =
+        C.ngx_stream_lua_ffi_balancer_set_timeouts
+
+    ngx_lua_ffi_balancer_set_timeouts =
+        function(r, connect_timeout, send_timeout, read_timeout, err)
+            local timeout = max(send_timeout, read_timeout)
+
+            return ngx_stream_lua_ffi_balancer_set_timeouts(r, connect_timeout,
+                                                            timeout, err)
+        end
+
+else
+    error("unknown subsystem: " .. subsystem)
+end
+
+
+local peer_state_names = {
+    [1] = "keepalive",
+    [2] = "next",
+    [4] = "failed",
+}
+
+
+local _M = { version = base.version }
+
+
+function _M.set_current_peer(addr, port)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if not port then
+        port = 0
+    elseif type(port) ~= "number" then
+        port = tonumber(port)
+    end
+
+    local rc = ngx_lua_ffi_balancer_set_current_peer(r, addr, #addr,
+                                                     port, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.set_more_tries(count)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_balancer_set_more_tries(r, count, errmsg)
+    if rc == FFI_OK then
+        if errmsg[0] == nil then
+            return true
+        end
+        return true, ffi_str(errmsg[0])  -- return the warning
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.get_last_failure()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local state = ngx_lua_ffi_balancer_get_last_failure(r, int_out, errmsg)
+
+    if state == 0 then
+        return nil
+    end
+
+    if state == FFI_ERROR then
+        return nil, nil, ffi_str(errmsg[0])
+    end
+
+    return peer_state_names[state] or "unknown", int_out[0]
+end
+
+
+function _M.set_timeouts(connect_timeout, send_timeout, read_timeout)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if not connect_timeout then
+        connect_timeout = 0
+    elseif type(connect_timeout) ~= "number" or connect_timeout <= 0 then
+        error("bad connect timeout", 2)
+    else
+        connect_timeout = connect_timeout * 1000
+    end
+
+    if not send_timeout then
+        send_timeout = 0
+    elseif type(send_timeout) ~= "number" or send_timeout <= 0 then
+        error("bad send timeout", 2)
+    else
+        send_timeout = send_timeout * 1000
+    end
+
+    if not read_timeout then
+        read_timeout = 0
+    elseif type(read_timeout) ~= "number" or read_timeout <= 0 then
+        error("bad read timeout", 2)
+    else
+        read_timeout = read_timeout * 1000
+    end
+
+    local rc
+
+    rc = ngx_lua_ffi_balancer_set_timeouts(r, connect_timeout,
+                                           send_timeout, read_timeout,
+                                           errmsg)
+
+    if rc == FFI_OK then
+        return true
+    end
+
+    return false, ffi_str(errmsg[0])
+end
+
+
+if subsystem == 'http' then
+    function _M.recreate_request()
+        local r = get_request()
+        if not r then
+            error("no request found")
+        end
+
+        local rc = C.ngx_http_lua_ffi_balancer_recreate_request(r, errmsg)
+        if rc == FFI_OK then
+            return true
+        end
+
+        if errmsg[0] ~= nil then
+            return nil, ffi_str(errmsg[0])
+        end
+
+        return nil, "failed to recreate the upstream request"
+    end
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/balancer.md

@@ -0,0 +1,335 @@
+Name
+====
+
+ngx.balancer - Lua API for defining dynamic upstream balancers in Lua
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+    * [http subsystem](#http-subsystem)
+    * [stream subsystem](#stream-subsystem)
+* [Description](#description)
+* [Methods](#methods)
+    * [set_current_peer](#set_current_peer)
+    * [set_more_tries](#set_more_tries)
+    * [get_last_failure](#get_last_failure)
+    * [set_timeouts](#set_timeouts)
+    * [recreate_request](#recreate_request)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+Synopsis
+========
+
+http subsystem
+--------------
+
+```nginx
+http {
+    upstream backend {
+        server 0.0.0.1;   # just an invalid address as a place holder
+
+        balancer_by_lua_block {
+            local balancer = require "ngx.balancer"
+
+            -- well, usually we calculate the peer's host and port
+            -- according to some balancing policies instead of using
+            -- hard-coded values like below
+            local host = "127.0.0.2"
+            local port = 8080
+
+            local ok, err = balancer.set_current_peer(host, port)
+            if not ok then
+                ngx.log(ngx.ERR, "failed to set the current peer: ", err)
+                return ngx.exit(500)
+            end
+        }
+
+        keepalive 10;  # connection pool
+    }
+
+    server {
+        # this is the real entry point
+        listen 80;
+
+        location / {
+            # make use of the upstream named "backend" defined above:
+            proxy_pass http://backend/fake;
+        }
+    }
+
+    server {
+        # this server is just for mocking up a backend peer here...
+        listen 127.0.0.2:8080;
+
+        location = /fake {
+            echo "this is the fake backend peer...";
+        }
+    }
+}
+```
+
+[Back to TOC](#table-of-contents)
+
+stream subsystem
+----------------
+
+```nginx
+stream {
+    upstream backend {
+        server 0.0.0.1:1234;   # just an invalid address as a place holder
+
+        balancer_by_lua_block {
+            local balancer = require "ngx.balancer"
+
+            -- well, usually we calculate the peer's host and port
+            -- according to some balancing policies instead of using
+            -- hard-coded values like below
+            local host = "127.0.0.2"
+            local port = 8080
+
+            local ok, err = balancer.set_current_peer(host, port)
+            if not ok then
+                ngx.log(ngx.ERR, "failed to set the current peer: ", err)
+                return ngx.exit(ngx.ERROR)
+            end
+        }
+    }
+
+    server {
+        # this is the real entry point
+        listen 10000;
+
+        # make use of the upstream named "backend" defined above:
+        proxy_pass backend;
+    }
+
+    server {
+        # this server is just for mocking up a backend peer here...
+        listen 127.0.0.2:8080;
+
+        echo "this is the fake backend peer...";
+    }
+}
+```
+
+[Back to TOC](#table-of-contents)
+
+Description
+===========
+
+This Lua module provides API functions to allow defining highly dynamic NGINX load balancers for
+any existing nginx upstream modules like [ngx_http_proxy_module](http://nginx.org/en/docs/http/ngx_http_proxy_module.html),
+[ngx_http_fastcgi_module](http://nginx.org/en/docs/http/ngx_http_fastcgi_module.html) and
+[ngx_stream_proxy_module](https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html).
+
+It allows you to dynamically select a backend peer to connect to (or retry) on a per-request
+basis from a list of backend peers which may also be dynamic.
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+All the methods of this module are static (or module-level). That is, you do not need an object (or instance)
+to call these methods.
+
+[Back to TOC](#table-of-contents)
+
+set_current_peer
+----------------
+**syntax:** *ok, err = balancer.set_current_peer(host, port)*
+
+**context:** *balancer_by_lua**
+
+Sets the peer address (host and port) for the current backend query (which may be a retry).
+
+Domain names in `host` do not make sense. You need to use OpenResty libraries like
+[lua-resty-dns](https://github.com/openresty/lua-resty-dns) to obtain IP address(es) from
+all the domain names before entering the `balancer_by_lua*` handler (for example,
+you can perform DNS lookups in an earlier phase like [access_by_lua*](https://github.com/openresty/lua-nginx-module#access_by_lua)
+and pass the results to the `balancer_by_lua*` handler via [ngx.ctx](https://github.com/openresty/lua-nginx-module#ngxctx).
+
+[Back to TOC](#table-of-contents)
+
+set_more_tries
+--------------
+**syntax:** *ok, err = balancer.set_more_tries(count)*
+
+**context:** *balancer_by_lua**
+
+Sets the tries performed when the current attempt (which may be a retry) fails (as determined
+by directives like [proxy_next_upstream](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream), depending on what
+particular nginx uptream module you are currently using). Note that the current attempt is *excluded* in the `count` number set here.
+
+Please note that, the total number of tries in a single downstream request cannot exceed the
+hard limit configured by directives like [proxy_next_upstream_tries](http://nginx.org/en/docs/http/ngx_http_proxy_module.html#proxy_next_upstream_tries),
+depending on what concrete nginx upstream module you are using. When exceeding this limit,
+the `count` value will get reduced to meet the limit and the second return value will be
+the string `"reduced tries due to limit"`, which is a warning, while the first return value
+is still a `true` value.
+
+[Back to TOC](#table-of-contents)
+
+get_last_failure
+----------------
+**syntax:** *state_name, status_code = balancer.get_last_failure()*
+
+**context:** *balancer_by_lua**
+
+Retrieves the failure details about the previous failed attempt (if any) when the `next_upstream` retrying
+mechanism is in action. When there was indeed a failed previous attempt, it returned a string describing
+that attempt's state name, as well as an integer describing the status code of that attempt.
+
+Possible state names are as follows:
+* `"next"`
+    Failures due to bad status codes sent from the backend server. The origin's response is same though, which means the backend connection
+can still be reused for future requests.
+* `"failed"`
+    Fatal errors while communicating to the backend server (like connection timeouts, connection resets, and etc). In this case,
+the backend connection must be aborted and cannot get reused.
+
+Possible status codes are those HTTP error status codes like `502` and `504`.
+
+For stream module, `status_code` will always be 0 (ngx.OK) and is provided for compatibility reasons.
+
+When the current attempt is the first attempt for the current downstream request (which means
+there is no previous attempts at all), this
+method always returns a single `nil` value.
+
+[Back to TOC](#table-of-contents)
+
+set_timeouts
+------------
+**syntax:** `ok, err = balancer.set_timeouts(connect_timeout, send_timeout, read_timeout)`
+
+**context:** *balancer_by_lua**
+
+Sets the upstream timeout (connect, send and read) in seconds for the current and any
+subsequent backend requests (which might be a retry).
+
+If you want to inherit the timeout value of the global `nginx.conf` configuration (like `proxy_connect_timeout`), then
+just specify the `nil` value for the corresponding argument (like the `connect_timeout` argument).
+
+Zero and negative timeout values are not allowed.
+
+You can specify millisecond precision in the timeout values by using floating point numbers like 0.001 (which means 1ms).
+
+**Note:** `send_timeout` and `read_timeout` are controlled by the same config
+[`proxy_timeout`](https://nginx.org/en/docs/stream/ngx_stream_proxy_module.html#proxy_timeout)
+for `ngx_stream_proxy_module`. To keep API compatibility, this function will use `max(send_timeout, read_timeout)`
+as the value for setting `proxy_timeout`.
+
+Returns `true` when the operation is successful; returns `nil` and a string describing the error
+otherwise.
+
+This only affects the current downstream request. It is not a global change.
+
+For the best performance, you should use the [OpenResty](https://openresty.org/) bundle.
+
+This function was first added in the `0.1.7` version of this library.
+
+[Back to TOC](#table-of-contents)
+
+recreate_request
+----------------
+**syntax:** `ok, err = balancer.recreate_request()`
+
+**context:** *balancer_by_lua**
+
+Recreates the request buffer for sending to the upstream server. This is useful, for example
+if you want to change a request header field to the new upstream server on balancer retries.
+
+Normally this does not work because the request buffer is created once during upstream module
+initialization and won't be regenerated for subsequent retries. However you can use
+`proxy_set_header My-Header $my_header` and set the `ngx.var.my_header` variable inside the
+balancer phase. Calling `balancer.recreate_request()` after updating a header field will
+cause the request buffer to be re-generated and the `My-Header` header will thus contain
+the new value.
+
+**Warning:** because the request buffer has to be recreated and such allocation occurs on the
+request memory pool, the old buffer has to be thrown away and will only be freed after the request
+finishes. Do not call this function too often or memory leaks may be noticeable. Even so, a call
+to this function should be made **only** if you know the request buffer must be regenerated,
+instead of unconditionally in each balancer retries.
+
+This function was first added in the `0.1.20` version of this library.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Yichun Zhang <agentzh@gmail.com> (agentzh), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2015-2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* the [balancer_by_lua*](https://github.com/openresty/lua-nginx-module#balancer_by_lua_block) directive.
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)

deps/src/lua-resty-core/lib/ngx/base64.lua

@@ -0,0 +1,89 @@
+-- Copyright (C) by Yichun Zhang (agentzh)
+-- Copyright (C) by OpenResty Inc.
+
+local ffi = require("ffi")
+local base = require("resty.core.base")
+
+
+local ffi_str = ffi.string
+local type = type
+local C = ffi.C
+local NGX_ERROR = ngx.ERROR
+
+
+local _M = { version = base.version }
+
+
+ffi.cdef[[
+typedef intptr_t        ngx_int_t;
+
+void ngx_encode_base64url(ngx_str_t *dst, ngx_str_t *src);
+ngx_int_t ngx_decode_base64url(ngx_str_t *dst, ngx_str_t *src);
+]]
+
+
+local get_string_buf = base.get_string_buf
+
+
+local dst_str_t = ffi.new("ngx_str_t[1]")
+local src_str_t = ffi.new("ngx_str_t[1]")
+
+
+local function base64_encoded_length(len)
+    return ((len + 2) / 3) * 4
+end
+
+
+local function base64_decoded_length(len)
+    return ((len + 3) / 4) * 3
+end
+
+
+function _M.encode_base64url(s)
+    if type(s) ~= "string" then
+        return nil, "must provide a string"
+    end
+
+    local len = #s
+    local trans_len = base64_encoded_length(len)
+    local src = src_str_t[0]
+    local dst = dst_str_t[0]
+
+    src.data = s
+    src.len = len
+
+    dst.data = get_string_buf(trans_len)
+    dst.len = trans_len
+
+    C.ngx_encode_base64url(dst_str_t, src_str_t)
+
+    return ffi_str(dst.data, dst.len)
+end
+
+
+function _M.decode_base64url(s)
+    if type(s) ~= "string" then
+        return nil, "must provide a string"
+    end
+
+    local len = #s
+    local trans_len = base64_decoded_length(len)
+    local src = src_str_t[0]
+    local dst = dst_str_t[0]
+
+    src.data = s
+    src.len = len
+
+    dst.data = get_string_buf(trans_len)
+    dst.len = trans_len
+
+    local ret = C.ngx_decode_base64url(dst_str_t, src_str_t)
+    if ret == NGX_ERROR then
+        return nil, "invalid input"
+    end
+
+    return ffi_str(dst.data, dst.len)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/base64.md

@@ -0,0 +1,137 @@
+Name
+====
+
+`ngx.base64` - urlsafe base64 encode/decode functions OpenResty/ngx\_lua.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Methods](#methods)
+    * [encode\_base64url](#encode_base64url)
+    * [decode\_base64url](#decode_base64url)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is production ready.
+
+Synopsis
+========
+
+```lua
+local b64 = require("ngx.base64")
+local res, err
+
+res = b64.encode_base64url("foo")
+
+res, err = b64.decode_base64url(res)
+if not res then
+    -- invalid input
+    ngx.log(ngx.ERR, err)
+end
+
+assert(res == "foo")
+```
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+encode\_base64url
+-----------------
+**syntax:** *encoded = base64.encode_base64url(input)*
+
+**context:** *any*
+
+Encode `input` using base64url rules. Returns the encoded string.
+
+[Back to TOC](#table-of-contents)
+
+decode\_base64url
+-----------------
+**syntax:** *decoded, err = base64.decode_base64url(input)*
+
+**context:** *any*
+
+Decode `input` using base64url rules. Returns the decoded string.
+
+If the `input` is not a valid base64url encoded string, `decoded `will be `nil`
+and `err` will be a string describing the error.
+
+[Back to TOC](#table-of-contents)
+
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Datong Sun <datong@openresty.com> (dndx), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)
+

deps/src/lua-resty-core/lib/ngx/errlog.lua

@@ -0,0 +1,170 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http', 'stream')
+
+
+local ffi = require 'ffi'
+local ffi_string = ffi.string
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local C = ffi.C
+local new_tab = base.new_tab
+local ffi_new = ffi.new
+local charpp = ffi_new("char *[1]")
+local intp = ffi.new("int[1]")
+local num_value = ffi_new("double[1]")
+local get_request = base.get_request
+local tonumber = tonumber
+local type = type
+local error = error
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_errlog_set_filter_level
+local ngx_lua_ffi_errlog_get_msg
+local ngx_lua_ffi_errlog_get_sys_filter_level
+local ngx_lua_ffi_raw_log
+
+
+local _M = { version = base.version }
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+int ngx_http_lua_ffi_errlog_set_filter_level(int level, unsigned char *err,
+    size_t *errlen);
+int ngx_http_lua_ffi_errlog_get_msg(char **log, int *loglevel,
+    unsigned char *err, size_t *errlen, double *log_time);
+
+int ngx_http_lua_ffi_errlog_get_sys_filter_level(ngx_http_request_t *r);
+
+int ngx_http_lua_ffi_raw_log(ngx_http_request_t *r, int level,
+    const unsigned char *s, size_t s_len);
+    ]]
+
+    ngx_lua_ffi_errlog_set_filter_level =
+        C.ngx_http_lua_ffi_errlog_set_filter_level
+    ngx_lua_ffi_errlog_get_msg = C.ngx_http_lua_ffi_errlog_get_msg
+    ngx_lua_ffi_errlog_get_sys_filter_level =
+        C.ngx_http_lua_ffi_errlog_get_sys_filter_level
+    ngx_lua_ffi_raw_log = C.ngx_http_lua_ffi_raw_log
+
+elseif subsystem == 'stream' then
+    ffi.cdef[[
+int ngx_stream_lua_ffi_errlog_set_filter_level(int level, unsigned char *err,
+    size_t *errlen);
+int ngx_stream_lua_ffi_errlog_get_msg(char **log, int *loglevel,
+    unsigned char *err, size_t *errlen, double *log_time);
+
+int ngx_stream_lua_ffi_errlog_get_sys_filter_level(ngx_stream_lua_request_t *r);
+
+int ngx_stream_lua_ffi_raw_log(ngx_stream_lua_request_t *r, int level,
+    const unsigned char *s, size_t s_len);
+    ]]
+
+    ngx_lua_ffi_errlog_set_filter_level =
+        C.ngx_stream_lua_ffi_errlog_set_filter_level
+    ngx_lua_ffi_errlog_get_msg = C.ngx_stream_lua_ffi_errlog_get_msg
+    ngx_lua_ffi_errlog_get_sys_filter_level =
+        C.ngx_stream_lua_ffi_errlog_get_sys_filter_level
+    ngx_lua_ffi_raw_log = C.ngx_stream_lua_ffi_raw_log
+end
+
+
+local ERR_BUF_SIZE = 128
+local FFI_ERROR = base.FFI_ERROR
+
+
+function _M.set_filter_level(level)
+    if not level then
+        return nil, [[missing "level" argument]]
+    end
+
+    local err = get_string_buf(ERR_BUF_SIZE)
+    local errlen = get_size_ptr()
+    errlen[0] = ERR_BUF_SIZE
+    local rc = ngx_lua_ffi_errlog_set_filter_level(level, err, errlen)
+
+    if rc == FFI_ERROR then
+        return nil, ffi_string(err, errlen[0])
+    end
+
+    return true
+end
+
+
+function _M.get_logs(max, logs)
+    local err = get_string_buf(ERR_BUF_SIZE)
+    local errlen = get_size_ptr()
+    errlen[0] = ERR_BUF_SIZE
+
+    local log = charpp
+    local loglevel = intp
+    local log_time = num_value
+
+    max = max or 10
+
+    if not logs then
+        logs = new_tab(max * 3 + 1, 0)
+    end
+
+    local count = 0
+
+    for i = 1, max do
+        local loglen = ngx_lua_ffi_errlog_get_msg(log, loglevel, err, errlen,
+                                                  log_time)
+        if loglen == FFI_ERROR then
+            return nil, ffi_string(err, errlen[0])
+        end
+
+        if loglen > 0 then
+            logs[count + 1] = loglevel[0]
+            logs[count + 2] = log_time[0]
+            logs[count + 3] = ffi_string(log[0], loglen)
+
+            count = count + 3
+        end
+
+        if loglen < 0 then  -- no error log
+            logs[count + 1] = nil
+            break
+        end
+
+        if i == max then    -- last one
+            logs[count + 1] = nil
+            break
+        end
+    end
+
+    return logs
+end
+
+
+function _M.get_sys_filter_level()
+    local r = get_request()
+    return tonumber(ngx_lua_ffi_errlog_get_sys_filter_level(r))
+end
+
+
+function _M.raw_log(level, msg)
+    if type(level) ~= "number" then
+        error("bad argument #1 to 'raw_log' (must be a number)", 2)
+    end
+
+    if type(msg) ~= "string" then
+        error("bad argument #2 to 'raw_log' (must be a string)", 2)
+    end
+
+    local r = get_request()
+
+    local rc = ngx_lua_ffi_raw_log(r, level, msg, #msg)
+
+    if rc == FFI_ERROR then
+        error("bad log level", 2)
+    end
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/errlog.md

@@ -0,0 +1,429 @@
+Name
+====
+
+`ngx.errlog` - manage nginx error log data in Lua for OpenResty/ngx_lua.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+    * [Capturing nginx error logs with specified log filtering level](#capturing-nginx-error-logs-with-specified-log-filtering-level)
+* [Methods](#methods)
+    * [set_filter_level](#set_filter_level)
+    * [get_logs](#get_logs)
+    * [get_sys_filter_level](#get_sys_filter_level)
+    * [raw_log](#raw_log)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+The API is still in flux and may change in the future without notice.
+
+Synopsis
+========
+
+Capturing nginx error logs with specified log filtering level
+-------------------------------------------------------------
+
+```nginx
+error_log logs/error.log info;
+
+http {
+    # enable capturing error logs
+    lua_capture_error_log 32m;
+
+    init_by_lua_block {
+        local errlog = require "ngx.errlog"
+        local status, err = errlog.set_filter_level(ngx.WARN)
+        if not status then
+            ngx.log(ngx.ERR, err)
+            return
+        end
+        ngx.log(ngx.WARN, "set error filter level: WARN")
+    }
+
+    server {
+        # ...
+        location = /t {
+            content_by_lua_block {
+                local errlog = require "ngx.errlog"
+                ngx.log(ngx.INFO, "test1")
+                ngx.log(ngx.WARN, "test2")
+                ngx.log(ngx.ERR, "test3")
+
+                local logs, err = errlog.get_logs(10)
+                if not logs then
+                    ngx.say("FAILED ", err)
+                    return
+                end
+
+                for i = 1, #logs, 3 do
+                    ngx.say("level: ", logs[i], " time: ", logs[i + 1],
+                            " data: ", logs[i + 2])
+                end
+            }
+        }
+    }
+}
+
+```
+
+The example location above produces a response like this:
+
+```
+level: 5 time: 1498546995.304 data: 2017/06/27 15:03:15 [warn] 46877#0:
+    [lua] init_by_lua:8: set error filter level: WARN
+level: 5 time: 1498546999.178 data: 2017/06/27 15:03:19 [warn] 46879#0: *1
+    [lua] test.lua:5: test2, client: 127.0.0.1, server: localhost, ......
+level: 4 time: 1498546999.178 data: 2017/06/27 15:03:19 [error] 46879#0: *1
+    [lua] test.lua:6: test3, client: 127.0.0.1, server: localhost, ......
+```
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+set_filter_level
+-----------------
+**syntax:** *status, err = log_module.set_filter_level(log_level)*
+
+**context:** *init_by_lua**
+
+Specifies the filter log level, only to capture and buffer the error logs with a log level
+no lower than the specified level.
+
+If we don't call this API, all of the error logs will be captured by default.
+
+In case of error, `nil` will be returned as well as a string describing the
+error.
+
+This API should always work with directive
+[lua_capture_error_log](https://github.com/openresty/lua-nginx-module#lua_capture_error_log).
+
+See [Nginx log level constants](https://github.com/openresty/lua-nginx-module#nginx-log-level-constants) for all nginx log levels.
+
+For example,
+
+```lua
+ init_by_lua_block {
+     local errlog = require "ngx.errlog"
+     errlog.set_filter_level(ngx.WARN)
+ }
+```
+
+*NOTE:* The debugging logs since when OpenResty or NGINX is not built with `--with-debug`, all the debug level logs are suppressed regardless.
+
+[Back to TOC](#table-of-contents)
+
+get_logs
+--------
+**syntax:** *res, err = log_module.get_logs(max?, res?)*
+
+**context:** *any*
+
+Fetches the captured nginx error log messages if any in the global data buffer
+specified by `ngx_lua`'s
+[lua_capture_error_log](https://github.com/openresty/lua-nginx-module#lua_capture_error_log)
+directive. Upon return, this Lua function also *removes* those messages from
+that global capturing buffer to make room for future new error log data.
+
+In case of error, `nil` will be returned as well as a string describing the
+error.
+
+The optional `max` argument is a number that when specified, will prevent
+`errlog.get_logs` from adding more than `max` messages to the `res` array.
+
+```lua
+for i = 1, 20 do
+   ngx.log(ngx.ERR, "test")
+end
+
+local errlog = require "ngx.errlog"
+local res = errlog.get_logs(10)
+-- the number of messages in the `res` table is 10 and the `res` table
+-- has 30 elements.
+```
+
+The resulting table has the following structure:
+
+```lua
+{ level1, time1, msg1, level2, time2, msg2, ... }
+```
+
+The `levelX` values are constants defined below:
+
+https://github.com/openresty/lua-nginx-module/#nginx-log-level-constants
+
+The `timeX` values are UNIX timestamps in seconds with millisecond precision. The sub-second part is presented as the decimal part.
+The time format is exactly the same as the value returned by [ngx.now](https://github.com/openresty/lua-nginx-module/#ngxnow). It is
+also subject to NGINX core's time caching.
+
+The `msgX` values are the error log message texts.
+
+So to traverse this array, the user can use a loop like this:
+
+```lua
+for i = 1, #res, 3 do
+    local level = res[i]
+    if not level then
+        break
+    end
+
+    local time = res[i + 1]
+    local msg = res[i + 2]
+
+    -- handle the current message with log level in `level`,
+    -- log time in `time`, and log message body in `msg`.
+end
+```
+
+Specifying `max <= 0` disables this behavior, meaning that the number of
+results won't be limited.
+
+The optional 2th argument `res` can be a user-supplied Lua table
+to hold the result instead of creating a brand new table. This can avoid
+unnecessary table dynamic allocations on hot Lua code paths. It is used like this:
+
+```lua
+local errlog = require "ngx.errlog"
+local new_tab = require "table.new"
+
+local buffer = new_tab(100 * 3, 0)  -- for 100 messages
+
+local errlog = require "ngx.errlog"
+local res, err = errlog.get_logs(0, buffer)
+if res then
+    -- res is the same table as `buffer`
+    for i = 1, #res, 3 do
+        local level = res[i]
+        if not level then
+            break
+        end
+        local time = res[i + 1]
+        local msg  = res[i + 2]
+        ...
+    end
+end
+```
+
+When provided with a `res` table, `errlog.get_logs` won't clear the table
+for performance reasons, but will rather insert a trailing `nil` value
+after the last table element.
+
+When the trailing `nil` is not enough for your purpose, you should
+clear the table yourself before feeding it into the `errlog.get_logs` function.
+
+[Back to TOC](#table-of-contents)
+
+get_sys_filter_level
+--------------------
+**syntax:** *log_level = log_module.get_sys_filter_level()*
+
+**context:** *any*
+
+Return the nginx core's error log filter level (defined via the [error_log](http://nginx.org/r/error_log)
+configuration directive in `nginx.conf`) as an integer value matching the nginx error log level
+constants documented below:
+
+https://github.com/openresty/lua-nginx-module/#nginx-log-level-constants
+
+For example:
+
+```lua
+local errlog = require "ngx.errlog"
+local log_level = errlog.get_sys_filter_level()
+-- Now the filter level is always one level higher than system default log level on priority
+local status, err = errlog.set_filter_level(log_level - 1)
+if not status then
+    ngx.log(ngx.ERR, err)
+    return
+end
+```
+
+[Back to TOC](#table-of-contents)
+
+raw_log
+-------
+**syntax:** *log_module.raw_log(log_level, msg)*
+
+**context:** *any*
+
+Log `msg` to the error logs with the given logging level.
+
+Just like the [ngx.log](https://github.com/openresty/lua-nginx-module#ngxlog)
+API, the `log_level` argument can take constants like `ngx.ERR` and `ngx.WARN`.
+Check out [Nginx log level constants for
+details.](https://github.com/openresty/lua-nginx-module#nginx-log-level-constants)
+
+However, unlike the `ngx.log` API which accepts variadic arguments, this
+function only accepts a single string as its second argument `msg`.
+
+This function differs from `ngx.log` in the way that it will not prefix the
+written logs with any sort of debug information (such as the caller's file
+and line number).
+
+For example, while `ngx.log` would produce
+
+```
+2017/07/09 19:36:25 [notice] 25932#0: *1 [lua] content_by_lua(nginx.conf:51):5: hello world, client: 127.0.0.1, server: localhost, request: "GET /log HTTP/1.1", host: "localhost"
+```
+
+from
+
+```lua
+ngx.log(ngx.NOTICE, "hello world")
+```
+
+the `errlog.raw_log()` call produces
+
+```
+2017/07/09 19:36:25 [notice] 25932#0: *1 hello world, client: 127.0.0.1, server: localhost, request: "GET /log HTTP/1.1", host: "localhost"
+```
+
+from
+
+```lua
+local errlog = require "ngx.errlog"
+errlog.raw_log(ngx.NOTICE, "hello world")
+```
+
+This function is best suited when the format and/or stack level of the debug
+information proposed by `ngx.log` is not desired. A good example of this would
+be a custom logging function which prefixes each log with a namespace in
+an application:
+
+```
+1.  local function my_log(lvl, ...)
+2.      ngx.log(lvl, "[prefix] ", ...)
+3.  end
+4.
+5.  my_log(ngx.ERR, "error")
+```
+
+Here, the produced log would indicate that this error was logged at line `2.`,
+when in reality, we wish the investigator of that log to realize it was logged
+at line `5.` right away.
+
+For such use cases (or other formatting reasons), one may use `raw_log` to
+create a logging utility that supports such requirements. Here is a suggested
+implementation:
+
+```lua
+local errlog = require "ngx.errlog"
+
+local function my_log(lvl, ...)
+  -- log to error logs with our custom prefix, stack level
+  -- and separator
+  local n = select("#", ...)
+  local t = { ... }
+  local info = debug.getinfo(2, "Sl")
+
+  local prefix = string.format("(%s):%d:", info.short_src, info.currentline)
+  local buf = { prefix }
+
+  for i = 1, n do
+    buf[i + 1] = tostring(t[i])
+  end
+
+  local msg = table.concat(buf, " ")
+
+  errlog.raw_log(lvl, msg) -- line 19.
+end
+
+local function my_function()
+  -- do something and log
+
+  my_log(ngx.ERR, "hello from", "raw_log:", true) -- line 25.
+end
+
+my_function()
+```
+
+This utility function will produce the following log, explicitly stating that
+the error was logged on line `25.`:
+
+```
+2017/07/09 20:03:07 [error] 26795#0: *2 (/path/to/file.lua):25: hello from raw_log: true, context: ngx.timer
+```
+
+As a reminder to the reader, one must be wary of the cost of string
+concatenation on the Lua land, and should prefer the combined use of a buffer
+table and `table.concat` to avoid unnecessary GC pressure.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Yuansheng Wang &lt;membphis@gmail.com&gt; (membphis), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)
+

deps/src/lua-resty-core/lib/ngx/ocsp.lua

@@ -0,0 +1,150 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http')
+
+
+local ffi = require "ffi"
+local C = ffi.C
+local ffi_str = ffi.string
+local get_request = base.get_request
+local error = error
+local tonumber = tonumber
+local errmsg = base.get_errmsg_ptr()
+local get_string_buf = base.get_string_buf
+local get_string_buf_size = base.get_string_buf_size
+local get_size_ptr = base.get_size_ptr
+local FFI_DECLINED = base.FFI_DECLINED
+local FFI_OK = base.FFI_OK
+local FFI_BUSY = base.FFI_BUSY
+
+
+ffi.cdef[[
+int ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain(
+    const char *chain_data, size_t chain_len, char *out, size_t *out_size,
+    char **err);
+
+int ngx_http_lua_ffi_ssl_create_ocsp_request(const char *chain_data,
+    size_t chain_len, unsigned char *out, size_t *out_size, char **err);
+
+int ngx_http_lua_ffi_ssl_validate_ocsp_response(const unsigned char *resp,
+    size_t resp_len, const char *chain_data, size_t chain_len,
+    unsigned char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_ssl_set_ocsp_status_resp(ngx_http_request_t *r,
+    const unsigned char *resp, size_t resp_len, char **err);
+]]
+
+
+local _M = { version = base.version }
+
+
+function _M.get_ocsp_responder_from_der_chain(certs, maxlen)
+
+    local buf_size = maxlen
+    if not buf_size then
+        buf_size = get_string_buf_size()
+    end
+    local buf = get_string_buf(buf_size)
+
+    local sizep = get_size_ptr()
+    sizep[0] = buf_size
+
+    local rc = C.ngx_http_lua_ffi_ssl_get_ocsp_responder_from_der_chain(certs,
+                                                   #certs, buf, sizep, errmsg)
+
+    if rc == FFI_DECLINED then
+        return nil
+    end
+
+    if rc == FFI_OK then
+        return ffi_str(buf, sizep[0])
+    end
+
+    if rc == FFI_BUSY then
+        return ffi_str(buf, sizep[0]), "truncated"
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.create_ocsp_request(certs, maxlen)
+
+    local buf_size = maxlen
+    if not buf_size then
+        buf_size = get_string_buf_size()
+    end
+    local buf = get_string_buf(buf_size)
+
+    local sizep = get_size_ptr()
+    sizep[0] = buf_size
+
+    local rc = C.ngx_http_lua_ffi_ssl_create_ocsp_request(certs,
+                                                          #certs, buf, sizep,
+                                                          errmsg)
+
+    if rc == FFI_OK then
+        return ffi_str(buf, sizep[0])
+    end
+
+    if rc == FFI_BUSY then
+        return nil, ffi_str(errmsg[0]) .. ": " .. tonumber(sizep[0])
+               .. " > " .. buf_size
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.validate_ocsp_response(resp, chain, max_errmsg_len)
+
+    local errbuf_size = max_errmsg_len
+    if not errbuf_size then
+        errbuf_size = get_string_buf_size()
+    end
+    local errbuf = get_string_buf(errbuf_size)
+
+    local sizep = get_size_ptr()
+    sizep[0] = errbuf_size
+
+    local rc = C.ngx_http_lua_ffi_ssl_validate_ocsp_response(
+                        resp, #resp, chain, #chain, errbuf, sizep)
+
+    if rc == FFI_OK then
+        return true
+    end
+
+    -- rc == FFI_ERROR
+
+    return nil, ffi_str(errbuf, sizep[0])
+end
+
+
+function _M.set_ocsp_status_resp(ocsp_resp)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = C.ngx_http_lua_ffi_ssl_set_ocsp_status_resp(r, ocsp_resp,
+                                                           #ocsp_resp,
+                                                           errmsg)
+
+    if rc == FFI_DECLINED then
+        -- no client status req
+        return true, "no status req"
+    end
+
+    if rc == FFI_OK then
+        return true
+    end
+
+    -- rc == FFI_ERROR
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/ocsp.md

@@ -0,0 +1,298 @@
+Name
+====
+
+ngx.ocsp - Lua API for implementing OCSP stapling in ssl_certificate_by_lua*
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [get_ocsp_responder_from_der_chain](#get_ocsp_responder_from_der_chain)
+    * [create_ocsp_request](#create_ocsp_request)
+    * [validate_ocsp_response](#validate_ocsp_response)
+    * [set_ocsp_status_resp](#set_ocsp_status_resp)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+Synopsis
+========
+
+```nginx
+# Note: you do not need the following line if you are using
+# OpenResty 1.9.7.2+.
+lua_package_path "/path/to/lua-resty-core/lib/?.lua;;";
+
+server {
+    listen 443 ssl;
+    server_name   test.com;
+
+    # useless placeholders: just to shut up NGINX configuration
+    # loader errors:
+    ssl_certificate /path/to/fallback.crt;
+    ssl_certificate_key /path/to/fallback.key;
+
+    ssl_certificate_by_lua_block {
+        local ssl = require "ngx.ssl"
+        local ocsp = require "ngx.ocsp"
+        local http = require "resty.http.simple"
+
+        -- assuming the user already defines the my_load_certificate_chain()
+        -- herself.
+        local pem_cert_chain = assert(my_load_certificate_chain())
+
+        local der_cert_chain, err = ssl.cert_pem_to_der(pem_cert_chain)
+        if not der_cert_chain then
+            ngx.log(ngx.ERR, "failed to convert certificate chain ",
+                    "from PEM to DER: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        local ocsp_url, err = ocsp.get_ocsp_responder_from_der_chain(der_cert_chain)
+        if not ocsp_url then
+            ngx.log(ngx.ERR, "failed to get OCSP responder: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        print("ocsp_url: ", ocsp_url)
+
+        -- use cosocket-based HTTP client libraries like lua-resty-http-simple
+        -- to send the request (url + ocsp_req as POST params or URL args) to
+        -- CA's OCSP server. assuming the server returns the OCSP response
+        -- in the Lua variable, resp.
+
+        local schema, host, port, ocsp_uri, err = parse_url(ocsp_url)
+
+        local ocsp_req, err = ocsp.create_ocsp_request(der_cert_chain)
+        if not ocsp_req then
+            ngx.log(ngx.ERR, "failed to create OCSP request: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        local res, err = http.request(host, port, {
+            path = ocsp_uri,
+            headers = { Host = host,
+                        ["Content-Type"] = "application/ocsp-request" },
+            timeout = 10000,  -- 10 sec
+            method = "POST",
+            body = ocsp_req,
+            maxsize = 102400,  -- 100KB
+        })
+
+        if not res then
+            ngx.log(ngx.ERR, "OCSP responder query failed: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        local http_status = res.status
+
+        if http_status ~= 200 then
+            ngx.log(ngx.ERR, "OCSP responder returns bad HTTP status code ",
+                    http_status)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        local ocsp_resp = res.body
+
+        if ocsp_resp and #ocsp_resp > 0 then
+            local ok, err = ocsp.validate_ocsp_response(ocsp_resp, der_cert_chain)
+            if not ok then
+                ngx.log(ngx.ERR, "failed to validate OCSP response: ", err)
+                return ngx.exit(ngx.ERROR)
+            end
+
+            -- set the OCSP stapling
+            ok, err = ocsp.set_ocsp_status_resp(ocsp_resp)
+            if not ok then
+                ngx.log(ngx.ERR, "failed to set ocsp status resp: ", err)
+                return ngx.exit(ngx.ERROR)
+            end
+        end
+    }
+
+    location / {
+        root html;
+    }
+}
+
+```
+
+Description
+===========
+
+This Lua module provides API to perform OCSP queries, OCSP response validations, and
+OCSP stapling planting.
+
+Usually, this module is used together with the [ngx.ssl](ssl.md) module in the
+context of [ssl_certificate_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block)
+(of the [ngx_lua](https://github.com/openresty/lua-nginx-module#readme) module).
+
+To load the `ngx.ocsp` module in Lua, just write
+
+```lua
+local ocsp = require "ngx.ocsp"
+```
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+get_ocsp_responder_from_der_chain
+---------------------------------
+**syntax:** *ocsp_url, err = ocsp.get_ocsp_responder_from_der_chain(der_cert_chain, max_len)*
+
+**context:** *any*
+
+Extracts the OCSP responder URL (like `"http://test.com/ocsp/"`) from the SSL server certificate chain in the DER format.
+
+Usually the SSL server certificate chain is originally formatted in PEM. You can use the Lua API
+provided by the [ngx.ssl](ssl.md) module to do the PEM to DER conversion.
+
+The optional `max_len` argument specifies the maximum length of OCSP URL allowed. This determines
+the buffer size; so do not specify an unnecessarily large value here. It defaults to the internal
+string buffer size used throughout this `lua-resty-core` library (usually default to 4KB).
+
+In case of failures, returns `nil` and a string describing the error.
+
+[Back to TOC](#table-of-contents)
+
+create_ocsp_request
+-------------------
+**syntax:** *ocsp_req, err = ocsp.create_ocsp_request(der_cert_chain, max_len)*
+
+**context:** *any*
+
+Builds an OCSP request from the SSL server certificate chain in the DER format, which
+can be used to send to the OCSP server for validation.
+
+The optional `max_len` argument specifies the maximum length of the OCSP request allowed.
+This value determines the size of the internal buffer allocated, so do not specify an
+unnecessarily large value here. It defaults to the internal string buffer size used
+throughout this `lua-resty-core` library (usually defaults to 4KB).
+
+In case of failures, returns `nil` and a string describing the error.
+
+The raw OCSP response data can be used as the request body directly if the POST method
+is used for the OCSP request. But for GET requests, you need to do base64 encoding and
+then URL encoding on the data yourself before appending it to the OCSP URL obtained
+by the [get_ocsp_responder_from_der_chain](#get_ocsp_responder_from_der_chain) function.
+
+[Back to TOC](#table-of-contents)
+
+validate_ocsp_response
+----------------------
+**syntax:** *ok, err = ocsp.validate_ocsp_response(ocsp_resp, der_cert_chain, max_err_msg_len)*
+
+**context:** *any*
+
+Validates the raw OCSP response data specified by the `ocsp_resp` argument using the SSL
+server certificate chain in DER format as specified in the `der_cert_chain` argument.
+
+Returns true when the validation is successful.
+
+In case of failures, returns `nil` and a string
+describing the failure. The maximum
+length of the error string is controlled by the optional `max_err_msg` argument (which defaults
+to the default internal string buffer size used throughout this `lua-resty-core` library, usually
+being 4KB).
+
+[Back to TOC](#table-of-contents)
+
+set_ocsp_status_resp
+--------------------
+**syntax:** *ok, err = ocsp.set_ocsp_status_resp(ocsp_resp)*
+
+**context:** *ssl_certificate_by_lua**
+
+Sets the OCSP response as the OCSP stapling for the current SSL connection.
+
+Returns `true` in case of successes. If the SSL client does not send a "status request"
+at all, then this method still returns `true` but also with a string as the warning
+`"no status req"`.
+
+In case of failures, returns `nil` and a string describing the error.
+
+The OCSP response is returned from CA's OCSP server. See the [create_ocsp_request](#create_ocsp_request)
+function for how to create an OCSP request and also [validate_ocsp_response](#validate_ocsp_response)
+for how to validate the OCSP response.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Yichun Zhang <agentzh@gmail.com> (agentzh), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2015-2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* the [ngx.ssl](ssl.md) module.
+* the [ssl_certificate_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block) directive.
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)

deps/src/lua-resty-core/lib/ngx/pipe.lua

@@ -0,0 +1,643 @@
+-- Copyright (C) by OpenResty Inc.
+
+
+local base = require "resty.core.base"
+base.allows_subsystem("http")
+
+
+require "resty.core.phase"  -- for ngx.get_phase
+
+local assert = assert
+local error = error
+local ipairs = ipairs
+local tonumber = tonumber
+local tostring = tostring
+local type = type
+local str_find = string.find
+local table_concat = table.concat
+local ffi = require "ffi"
+local C = ffi.C
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local ngx_phase = ngx.get_phase
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local get_request = base.get_request
+local FFI_AGAIN = base.FFI_AGAIN
+local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT
+local FFI_DECLINED = base.FFI_DECLINED
+local FFI_ERROR = base.FFI_ERROR
+local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX
+local FFI_OK = base.FFI_OK
+local co_yield = coroutine._yield
+
+
+ffi.cdef[[
+typedef int                         ngx_pid_t;
+typedef uintptr_t                   ngx_msec_t;
+typedef unsigned char               u_char;
+typedef struct ngx_http_lua_pipe_s  ngx_http_lua_pipe_t;
+
+typedef struct {
+    ngx_pid_t               _pid;
+    ngx_msec_t              write_timeout;
+    ngx_msec_t              stdout_read_timeout;
+    ngx_msec_t              stderr_read_timeout;
+    ngx_msec_t              wait_timeout;
+    ngx_http_lua_pipe_t    *pipe;
+} ngx_http_lua_ffi_pipe_proc_t;
+
+int ngx_http_lua_ffi_pipe_spawn(ngx_http_lua_ffi_pipe_proc_t *proc,
+    const char *file, const char **argv, int merge_stderr, size_t buffer_size,
+    const char **environ, u_char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_proc_read(ngx_http_request_t *r,
+    ngx_http_lua_ffi_pipe_proc_t *proc, int from_stderr, int reader_type,
+    size_t length, u_char **buf, size_t *buf_size, u_char *errbuf,
+    size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_get_read_result(ngx_http_request_t *r,
+    ngx_http_lua_ffi_pipe_proc_t *proc, int from_stderr, u_char **buf,
+    size_t *buf_size, u_char *errbuf, size_t *errbuf_size);
+
+ssize_t ngx_http_lua_ffi_pipe_proc_write(ngx_http_request_t *r,
+    ngx_http_lua_ffi_pipe_proc_t *proc, const u_char *data, size_t len,
+    u_char *errbuf, size_t *errbuf_size);
+
+ssize_t ngx_http_lua_ffi_pipe_get_write_result(ngx_http_request_t *r,
+    ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_proc_shutdown_stdin(
+    ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_proc_shutdown_stdout(
+    ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_proc_shutdown_stderr(
+    ngx_http_lua_ffi_pipe_proc_t *proc, u_char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_proc_wait(ngx_http_request_t *r,
+    ngx_http_lua_ffi_pipe_proc_t *proc, char **reason, int *status,
+    u_char *errbuf, size_t *errbuf_size);
+
+int ngx_http_lua_ffi_pipe_proc_kill(ngx_http_lua_ffi_pipe_proc_t *proc,
+    int signal, u_char *errbuf, size_t *errbuf_size);
+
+void ngx_http_lua_ffi_pipe_proc_destroy(ngx_http_lua_ffi_pipe_proc_t *proc);
+]]
+
+
+if not pcall(function() return C.ngx_http_lua_ffi_pipe_spawn end) then
+    error("pipe API is not supported due to either a platform issue " ..
+          "or lack of the HAVE_SOCKET_CLOEXEC_PATCH patch", 2)
+end
+
+
+local _M = { version = base.version }
+
+
+local ERR_BUF_SIZE = 256
+local VALUE_BUF_SIZE = 512
+local PIPE_READ_ALL   = 0
+local PIPE_READ_BYTES = 1
+local PIPE_READ_LINE  = 2
+local PIPE_READ_ANY   = 3
+
+
+local proc_set_timeouts
+do
+    local MAX_TIMEOUT = 0xffffffff
+
+    function proc_set_timeouts(proc, write_timeout, stdout_read_timeout,
+                               stderr_read_timeout, wait_timeout)
+
+        -- the implementation below is straightforward but could not be JIT
+        -- compiled by the latest LuaJIT. When called in loops, LuaJIT will try
+        -- to unroll it, and fall back to interpreter after it reaches the
+        -- unroll limit.
+        --[[
+        local function set_timeout(proc, attr, timeout)
+            if timeout then
+                if timeout > MAX_TIMEOUT then
+                    error("bad timeout value", 3)
+                end
+                proc[attr] = timeout
+            end
+        end
+        set_timeout(...)
+        ]]
+
+        if write_timeout then
+            if write_timeout < 0 or MAX_TIMEOUT < write_timeout then
+                error("bad write_timeout option", 3)
+            end
+
+            proc.write_timeout = write_timeout
+        end
+
+        if stdout_read_timeout then
+            if stdout_read_timeout < 0 or MAX_TIMEOUT < stdout_read_timeout then
+                error("bad stdout_read_timeout option", 3)
+            end
+
+            proc.stdout_read_timeout = stdout_read_timeout
+        end
+
+        if stderr_read_timeout then
+            if stderr_read_timeout < 0 or MAX_TIMEOUT < stderr_read_timeout then
+                error("bad stderr_read_timeout option", 3)
+            end
+
+            proc.stderr_read_timeout = stderr_read_timeout
+        end
+
+        if wait_timeout then
+            if wait_timeout < 0 or MAX_TIMEOUT < wait_timeout then
+                error("bad wait_timeout option", 3)
+            end
+
+            proc.wait_timeout = wait_timeout
+        end
+    end
+end
+
+
+local function check_proc_instance(proc)
+    if type(proc) ~= "cdata" then
+        error("not a process instance", 3)
+    end
+end
+
+
+local proc_read
+do
+    local value_buf = ffi_new("char[?]", VALUE_BUF_SIZE)
+    local buf = ffi_new("char *[1]")
+    local buf_size = ffi_new("size_t[1]")
+
+    function proc_read(proc, stderr, reader_type, len)
+        check_proc_instance(proc)
+
+        local r = get_request()
+        if not r then
+            error("no request found")
+        end
+
+        buf[0] = value_buf
+        buf_size[0] = VALUE_BUF_SIZE
+        local errbuf = get_string_buf(ERR_BUF_SIZE)
+        local errbuf_size = get_size_ptr()
+        errbuf_size[0] = ERR_BUF_SIZE
+        local rc = C.ngx_http_lua_ffi_pipe_proc_read(r, proc, stderr,
+                                                     reader_type, len, buf,
+                                                     buf_size, errbuf,
+                                                     errbuf_size)
+        if rc == FFI_NO_REQ_CTX then
+            error("no request ctx found")
+        end
+
+        if rc == FFI_BAD_CONTEXT then
+            error(ffi_str(errbuf, errbuf_size[0]), 2)
+        end
+
+        while true do
+            if rc == FFI_ERROR then
+                return nil, ffi_str(errbuf, errbuf_size[0])
+            end
+
+            if rc == FFI_OK then
+                local p = buf[0]
+                if p ~= value_buf then
+                    p = ffi_new("char[?]", buf_size[0])
+                    buf[0] = p
+                    C.ngx_http_lua_ffi_pipe_get_read_result(r, proc, stderr,
+                                                            buf, buf_size,
+                                                            errbuf, errbuf_size)
+                    assert(p == buf[0])
+                end
+
+                return ffi_str(p, buf_size[0])
+            end
+
+            if rc == FFI_DECLINED then
+                local err = ffi_str(errbuf, errbuf_size[0])
+
+                local p = buf[0]
+                if p ~= value_buf then
+                    p = ffi_new("char[?]", buf_size[0])
+                    buf[0] = p
+                    C.ngx_http_lua_ffi_pipe_get_read_result(r, proc, stderr,
+                                                            buf, buf_size,
+                                                            errbuf, errbuf_size)
+                    assert(p == buf[0])
+                end
+
+                local partial = ffi_str(p, buf_size[0])
+                return nil, err, partial
+            end
+
+            assert(rc == FFI_AGAIN)
+
+            co_yield()
+
+            buf[0] = value_buf
+            buf_size[0] = VALUE_BUF_SIZE
+            errbuf = get_string_buf(ERR_BUF_SIZE)
+            errbuf_size = get_size_ptr()
+            errbuf_size[0] = ERR_BUF_SIZE
+            rc = C.ngx_http_lua_ffi_pipe_get_read_result(r, proc, stderr, buf,
+                                                         buf_size, errbuf,
+                                                         errbuf_size)
+        end
+    end
+
+end
+
+
+local function proc_write(proc, data)
+    check_proc_instance(proc)
+
+    local r = get_request()
+    if not r then
+        error("no request found", 2)
+    end
+
+    local data_type = type(data)
+    if data_type ~= "string" then
+        if data_type == "table" then
+            data = table_concat(data, "")
+
+        elseif data_type == "number" then
+            data = tostring(data)
+
+        else
+            error("bad data arg: string, number, or table expected, got "
+                  .. data_type, 2)
+        end
+    end
+
+    local errbuf = get_string_buf(ERR_BUF_SIZE)
+    local errbuf_size = get_size_ptr()
+    errbuf_size[0] = ERR_BUF_SIZE
+    local rc = C.ngx_http_lua_ffi_pipe_proc_write(r, proc, data, #data, errbuf,
+                                                  errbuf_size)
+    if rc == FFI_NO_REQ_CTX then
+        error("no request ctx found", 2)
+    end
+
+    if rc == FFI_BAD_CONTEXT then
+        error(ffi_str(errbuf, errbuf_size[0]), 2)
+    end
+
+    while true do
+        if rc == FFI_ERROR then
+            return nil, ffi_str(errbuf, errbuf_size[0])
+        end
+
+        if rc >= 0 then
+            -- rc holds the bytes sent
+            return tonumber(rc)
+        end
+
+        assert(rc == FFI_AGAIN)
+
+        co_yield()
+
+        errbuf = get_string_buf(ERR_BUF_SIZE)
+        errbuf_size = get_size_ptr()
+        errbuf_size[0] = ERR_BUF_SIZE
+        rc = C.ngx_http_lua_ffi_pipe_get_write_result(r, proc, errbuf,
+                                                      errbuf_size)
+    end
+end
+
+
+local function proc_shutdown(proc, direction)
+    check_proc_instance(proc)
+
+    local rc
+    local errbuf = get_string_buf(ERR_BUF_SIZE)
+    local errbuf_size = get_size_ptr()
+    errbuf_size[0] = ERR_BUF_SIZE
+
+    if direction == "stdin" then
+        rc = C.ngx_http_lua_ffi_pipe_proc_shutdown_stdin(proc, errbuf,
+                                                         errbuf_size)
+
+    elseif direction == "stdout" then
+        rc = C.ngx_http_lua_ffi_pipe_proc_shutdown_stdout(proc, errbuf,
+                                                          errbuf_size)
+
+    elseif direction == "stderr" then
+        rc = C.ngx_http_lua_ffi_pipe_proc_shutdown_stderr(proc, errbuf,
+                                                          errbuf_size)
+
+    else
+        error("bad shutdown arg: " .. direction, 2)
+    end
+
+    if rc == FFI_ERROR then
+        return nil, ffi_str(errbuf, errbuf_size[0])
+    end
+
+    return true
+end
+
+
+local proc_wait
+do
+    local reason = ffi_new("char *[1]")
+    local status = ffi_new("int[1]")
+
+    function proc_wait(proc)
+        check_proc_instance(proc)
+
+        local r = get_request()
+        if not r then
+            error("no request found", 2)
+        end
+
+        local errbuf = get_string_buf(ERR_BUF_SIZE)
+        local errbuf_size = get_size_ptr()
+        errbuf_size[0] = ERR_BUF_SIZE
+        local rc = C.ngx_http_lua_ffi_pipe_proc_wait(r, proc, reason, status,
+                                                     errbuf, errbuf_size)
+        if rc == FFI_NO_REQ_CTX then
+            error("no request ctx found", 2)
+        end
+
+        if rc == FFI_BAD_CONTEXT then
+            error(ffi_str(errbuf, errbuf_size[0]), 2)
+        end
+
+        if rc == FFI_ERROR then
+            return nil, ffi_str(errbuf, errbuf_size[0])
+        end
+
+        if rc == FFI_OK then
+            return true, ffi_str(reason[0]), tonumber(status[0])
+        end
+
+        if rc == FFI_DECLINED then
+            return false, ffi_str(reason[0]), tonumber(status[0])
+        end
+
+        local ok, exit_reason, exit_status
+        ok, exit_reason, exit_status = co_yield()
+        return ok, exit_reason, exit_status
+    end
+end
+
+
+local function proc_kill(proc, signal)
+    check_proc_instance(proc)
+
+    if type(signal) ~= "number" then
+        error("bad signal arg: number expected, got " .. tostring(signal), 2)
+    end
+
+    local errbuf = get_string_buf(ERR_BUF_SIZE)
+    local errbuf_size = get_size_ptr()
+    errbuf_size[0] = ERR_BUF_SIZE
+
+    local rc = C.ngx_http_lua_ffi_pipe_proc_kill(proc, signal, errbuf,
+                                                 errbuf_size)
+    if rc == FFI_ERROR then
+        return nil, ffi_str(errbuf, errbuf_size[0])
+    end
+
+    return true
+end
+
+
+local mt = {
+    __gc = C.ngx_http_lua_ffi_pipe_proc_destroy,
+
+    __index = {
+        pid = function (proc)
+            return proc._pid
+        end,
+
+        set_timeouts = function (proc, write_timeout, stdout_read_timeout,
+                                 stderr_read_timeout, wait_timeout)
+            proc_set_timeouts(proc, write_timeout, stdout_read_timeout,
+                              stderr_read_timeout, wait_timeout)
+        end,
+
+        stdout_read_all = function (proc)
+            local data, err, partial = proc_read(proc, 0, PIPE_READ_ALL, 0)
+            return data, err, partial
+        end,
+
+        stdout_read_bytes = function (proc, len)
+            if len <= 0 then
+                if len < 0 then
+                    error("bad len argument", 2)
+                end
+
+                return ""
+            end
+
+            local data, err, partial = proc_read(proc, 0, PIPE_READ_BYTES, len)
+            return data, err, partial
+        end,
+
+        stdout_read_line = function (proc)
+            local data, err, partial = proc_read(proc, 0, PIPE_READ_LINE, 0)
+            return data, err, partial
+        end,
+
+        stdout_read_any = function (proc, max)
+            if type(max) ~= "number" then
+                max = tonumber(max)
+            end
+
+            if not max or max <= 0 then
+                error("bad max argument", 2)
+            end
+
+            local data, err, partial = proc_read(proc, 0, PIPE_READ_ANY, max)
+            return data, err, partial
+        end,
+
+        stderr_read_all = function (proc)
+            local data, err, partial = proc_read(proc, 1, PIPE_READ_ALL, 0)
+            return data, err, partial
+        end,
+
+        stderr_read_bytes = function (proc, len)
+            if len <= 0 then
+                if len < 0 then
+                    error("bad len argument", 2)
+                end
+
+                return ""
+            end
+
+            local data, err, partial = proc_read(proc, 1, PIPE_READ_BYTES, len)
+            return data, err, partial
+        end,
+
+        stderr_read_line = function (proc)
+            local data, err, partial = proc_read(proc, 1, PIPE_READ_LINE, 0)
+            return data, err, partial
+        end,
+
+        stderr_read_any = function (proc, max)
+            if type(max) ~= "number" then
+                max = tonumber(max)
+            end
+
+            if not max or max <= 0 then
+                error("bad max argument", 2)
+            end
+
+            local data, err, partial = proc_read(proc, 1, PIPE_READ_ANY, max)
+            return data, err, partial
+        end,
+
+        write = proc_write,
+        shutdown = proc_shutdown,
+        wait = proc_wait,
+        kill = proc_kill,
+    }
+}
+local Proc = ffi.metatype("ngx_http_lua_ffi_pipe_proc_t", mt)
+
+
+local pipe_spawn
+do
+    local sh_exe = "/bin/sh"
+    local opt_c = "-c"
+    local shell_args = ffi_new("const char* [?]", 4)
+    shell_args[0] = sh_exe
+    shell_args[1] = opt_c
+    shell_args[3] = nil
+
+    local write_timeout = 10000
+    local stdout_read_timeout = 10000
+    local stderr_read_timeout = 10000
+    local wait_timeout = 10000
+
+    -- reference shell cmd's constant strings here to prevent them from getting
+    -- collected by the Lua GC.
+    _M._gc_ref_c_opt = opt_c
+
+    function pipe_spawn(args, opts)
+        if ngx_phase() == "init" then
+            error("API disabled in the current context", 2)
+        end
+
+        local exe
+        local proc_args
+        local proc_envs
+
+        local args_type = type(args)
+        if args_type == "table" then
+            local nargs = 0
+
+            for i, arg in ipairs(args)  do
+                nargs = nargs + 1
+
+                if type(arg) ~= "string" then
+                    args[i] = tostring(arg)
+                end
+            end
+
+            if nargs == 0 then
+                error("bad args arg: non-empty table expected", 2)
+            end
+
+            exe = args[1]
+            proc_args = ffi_new("const char* [?]", nargs + 1, args)
+            proc_args[nargs] = nil
+
+        elseif args_type == "string" then
+            exe = sh_exe
+            shell_args[2] = args
+            proc_args = shell_args
+
+        else
+            error("bad args arg: table expected, got " .. args_type, 2)
+        end
+
+        local merge_stderr = 0
+        local buffer_size = 4096
+        local proc = Proc()
+
+        if opts then
+            merge_stderr = opts.merge_stderr and 1 or 0
+
+            if opts.buffer_size then
+                buffer_size = tonumber(opts.buffer_size)
+
+                if not buffer_size or buffer_size < 1 then
+                    error("bad buffer_size option", 2)
+                end
+            end
+
+            if opts.environ then
+                local environ = opts.environ
+                local environ_type = type(environ)
+                if environ_type ~= "table" then
+                    error("bad environ option: table expected, got " ..
+                          environ_type, 2)
+                end
+
+                local nenv = 0
+
+                for i, env in ipairs(environ) do
+                    nenv = nenv + 1
+
+                    local env_type = type(env)
+                    if env_type ~= "string" then
+                        error("bad value at index " .. i .. " of environ " ..
+                              "option: string expected, got " .. env_type, 2)
+                    end
+
+                    if not str_find(env, "=", 2, true) then
+                        error("bad value at index " .. i .. " of environ " ..
+                              "option: 'name=[value]' format expected, got '" ..
+                              env .. "'", 2)
+                    end
+                end
+
+                if nenv > 0 then
+                    proc_envs = ffi_new("const char* [?]", nenv + 1, environ)
+                    proc_envs[nenv] = nil
+                end
+            end
+
+            proc_set_timeouts(proc,
+                              opts.write_timeout or write_timeout,
+                              opts.stdout_read_timeout or stdout_read_timeout,
+                              opts.stderr_read_timeout or stderr_read_timeout,
+                              opts.wait_timeout or wait_timeout)
+
+        else
+            proc_set_timeouts(proc,
+                              write_timeout,
+                              stdout_read_timeout,
+                              stderr_read_timeout,
+                              wait_timeout)
+        end
+
+        local errbuf = get_string_buf(ERR_BUF_SIZE)
+        local errbuf_size = get_size_ptr()
+        errbuf_size[0] = ERR_BUF_SIZE
+        local rc = C.ngx_http_lua_ffi_pipe_spawn(proc, exe, proc_args,
+                                                 merge_stderr, buffer_size,
+                                                 proc_envs, errbuf, errbuf_size)
+        if rc == FFI_ERROR then
+            return nil, ffi_str(errbuf, errbuf_size[0])
+        end
+
+        return proc
+    end
+end  -- do
+
+
+_M.spawn = pipe_spawn
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/pipe.md

@@ -0,0 +1,584 @@
+Name
+====
+
+`ngx.pipe` - spawn and communicate with OS processes via stdin/stdout/stderr in
+a non-blocking fashion.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [spawn](#spawn)
+    * [set_timeouts](#set_timeouts)
+    * [wait](#wait)
+    * [pid](#pid)
+    * [kill](#kill)
+    * [shutdown](#shutdown)
+    * [write](#write)
+    * [stderr_read_all](#stderr_read_all)
+    * [stdout_read_all](#stdout_read_all)
+    * [stderr_read_line](#stderr_read_line)
+    * [stdout_read_line](#stdout_read_line)
+    * [stderr_read_bytes](#stderr_read_bytes)
+    * [stdout_read_bytes](#stdout_read_bytes)
+    * [stderr_read_any](#stderr_read_any)
+    * [stdout_read_any](#stdout_read_any)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+Synopsis
+========
+
+```nginx
+location = /t {
+    content_by_lua_block {
+        local ngx_pipe = require "ngx.pipe"
+        local select = select
+
+        local function count_char(...)
+            local proc = ngx_pipe.spawn({'wc', '-c'})
+            local n = select('#', ...)
+            for i = 1, n do
+                local arg = select(i, ...)
+                local bytes, err = proc:write(arg)
+                if not bytes then
+                    ngx.say(err)
+                    return
+                end
+            end
+
+            local ok, err = proc:shutdown('stdin')
+            if not ok then
+                ngx.say(err)
+                return
+            end
+
+            local data, err = proc:stdout_read_line()
+            if not data then
+                ngx.say(err)
+                return
+            end
+
+            ngx.say(data)
+        end
+
+        count_char(("1234"):rep(2048))
+    }
+}
+```
+
+This example counts characters (bytes) directly fed by OpenResty to the UNIX
+command `wc`.
+
+You could not do this with either `io.popen` or `os.execute` because `wc` will
+not output the result until its stdin is closed.
+
+[Back to TOC](#table-of-contents)
+
+Description
+===========
+
+This module does not support non-POSIX operating systems like Windows yet.
+
+If you are not using the Nginx core shipped with OpenResty, you will need to
+apply the `socket_cloexec` patch to the standard Nginx core.
+
+Under the hood, this module uses `fork` and `execvp` with the user-specified
+command, and communicate with such spawned processes via the POSIX `pipe` API,
+which contributes to the name of this module.
+
+A signal handler for `SIGCHLD` is registered so that we can receive a
+notification once the spawned processes exited.
+
+We combine the above implementation with Nginx's event mechanism and
+OpenResty's Lua coroutine scheduler, in order to ensure communication with the
+spawned processes is non-blocking.
+
+The communication APIs do not work in phases which do not support yielding,
+such as `init_worker_by_lua*` or `log_by_lua*`, because there is no way to
+yield the current light thread to avoid blocking the OS thread when
+communicating with processes in those phases.
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+spawn
+-----
+**syntax:** *proc, err = pipe_module.spawn(args, opts?)*
+
+**context:** *all phases except init_by_lua**
+
+Creates and returns a new sub-process instance we can communicate with later.
+
+For example:
+
+```lua
+local ngx_pipe = require "ngx.pipe"
+local proc, err = ngx_pipe.spawn({"sh", "-c", "sleep 0.1 && exit 2"})
+if not proc then
+    ngx.say(err)
+    return
+end
+```
+
+In case of failure, this function returns `nil` and a string describing the
+error.
+
+The sub-process will be killed via `SIGKILL` if it is still alive when the
+instance is collected by the garbage collector.
+
+Note that `args` should either be a single level array-like Lua table with
+string values, or just a single string.
+
+Some more examples:
+
+```lua
+local proc, err = ngx_pipe.spawn({"ls", "-l"})
+
+local proc, err = ngx_pipe.spawn({"perl", "-e", "print 'hello, wolrd'"})
+```
+
+If `args` is specified as a string, it will be executed by the operating system
+shell, just like `os.execute`. The above example could thus be rewritten as:
+
+```lua
+local ngx_pipe = require "ngx.pipe"
+local proc, err = ngx_pipe.spawn("sleep 0.1 && exit 2")
+if not proc then
+    ngx.say(err)
+    return
+end
+```
+
+In the shell mode, you should be very careful about shell injection attacks
+when interpolating variables into command string, especially variables from
+untrusted sources. Please make sure that you escape those variables while
+assembling the command string. For this reason, it is highly recommended to use
+the multi-arguments form (`args` as a table) to specify each command-line
+argument explicitly.
+
+Since by default, Nginx does not pass along the `PATH` system environment
+variable, you will need to configure the `env PATH` directive if you wish for
+it to be respected during the searching of sub-processes:
+
+```nginx
+env PATH;
+...
+content_by_lua_block {
+    local ngx_pipe = require "ngx.pipe"
+
+    local proc = ngx_pipe.spawn({'ls'})
+}
+```
+
+The optional table argument `opts` can be used to control the behavior of
+spawned processes. For instance:
+
+```lua
+local opts = {
+    merge_stderr = true,
+    buffer_size = 256,
+    environ = {"PATH=/tmp/bin", "CWD=/tmp/work"}
+}
+local proc, err = ngx_pipe.spawn({"sh", "-c", ">&2 echo data"}, opts)
+if not proc then
+    ngx.say(err)
+    return
+end
+```
+
+The following options are supported:
+
+* `merge_stderr`: when set to `true`, the output to stderr will be redirected
+  to stdout in the spawned process. This is similar to doing `2>&1` in a shell.
+* `buffer_size`: specifies the buffer size used by reading operations, in
+  bytes. The default buffer size is `4096`.
+* `environ`: specifies environment variables for the spawned process. The value
+  must be a single-level, array-like Lua table with string values. If the
+  current platform does not support this option, `nil` plus a string `"environ
+  option not supported"` will be returned.
+* `write_timeout`: specifies the write timeout threshold, in milliseconds. The
+  default threshold is `10000`. If the threshold is `0`, the write operation
+  will never time out.
+* `stdout_read_timeout`: specifies the stdout read timeout threshold, in
+  milliseconds. The default threshold is `10000`. If the threshold is `0`, the
+  stdout read operation will never time out.
+* `stderr_read_timeout`: specifies the stderr read timeout threshold, in
+  milliseconds. The default threshold is `10000`. If the threshold is `0`, the
+  stderr read operation will never time out.
+* `wait_timeout`: specifies the wait timeout threshold, in milliseconds. The
+  default threshold is `10000`. If the threshold is `0`, the wait operation
+  will never time out.
+
+[Back to TOC](#table-of-contents)
+
+set_timeouts
+------------
+**syntax:** *proc:set_timeouts(write_timeout?, stdout_read_timeout?, stderr_read_timeout?, wait_timeout?)*
+
+Respectively sets: the write timeout threshold, stdout read timeout threshold,
+stderr read timeout threshold, and wait timeout threshold. All timeouts are in
+milliseconds.
+
+The default threshold for each timeout is 10 seconds.
+
+If the specified timeout argument is `nil`, the corresponding timeout threshold
+will not be changed. For example:
+
+```lua
+local proc, err = ngx_pipe.spawn({"sleep", "10s"})
+
+-- only change the wait_timeout to 0.1 second.
+proc:set_timeouts(nil, nil, nil, 100)
+
+-- only change the send_timeout to 0.1 second.
+proc:set_timeouts(100)
+```
+
+If the specified timeout argument is `0`, the corresponding operation will
+never time out.
+
+[Back to TOC](#table-of-contents)
+
+wait
+----
+**syntax:** *ok, reason, status = proc:wait()*
+
+**context:** *phases that support yielding*
+
+Waits until the current sub-process exits.
+
+It is possible to control how long to wait via [set_timeouts](#set_timeouts).
+The default timeout is 10 seconds.
+
+If process exited with status code zero, the `ok` return value will be `true`.
+
+If process exited abnormally, the `ok` return value will be `false`.
+
+The second return value, `reason`, will be a string. Its values may be:
+
+* `exit`: the process exited by calling `exit(3)`, `_exit(2)`, or by
+  returning from `main()`. In this case, `status` will be the exit code.
+* `signal`: the process was terminated by a signal. In this case, `status` will
+  be the signal number.
+
+Note that only one light thread can wait on a process at a time. If another
+light thread tries to wait on a process, the return values will be `nil` and
+the error string `"pipe busy waiting"`.
+
+If a thread tries to wait an exited process, the return values will be `nil`
+and the error string `"exited"`.
+
+[Back to TOC](#table-of-contents)
+
+pid
+---
+**syntax:** *pid = proc:pid()*
+
+Returns the pid number of the sub-process.
+
+[Back to TOC](#table-of-contents)
+
+kill
+----
+**syntax:** *ok, err = proc:kill(signum)*
+
+Sends a signal to the sub-process.
+
+Note that the `signum` argument should be signal's numerical value. If the
+specified `signum` is not a number, an error will be thrown.
+
+You should use [lua-resty-signal's signum()
+function](https://github.com/openresty/lua-resty-signal#signum) to convert
+signal names to signal numbers in order to ensure portability of your
+application.
+
+In case of success, this method returns `true`. Otherwise, it returns `nil` and
+a string describing the error.
+
+Killing an exited sub-process will return `nil` and the error string
+`"exited"`.
+
+Sending an invalid signal to the process will return `nil` and the error string
+`"invalid signal"`.
+
+[Back to TOC](#table-of-contents)
+
+shutdown
+--------
+**syntax:** *ok, err = proc:shutdown(direction)*
+
+Closes the specified direction of the current sub-process.
+
+The `direction` argument should be one of these three values: `stdin`, `stdout`
+and `stderr`.
+
+In case of success, this method returns `true`. Otherwise, it returns `nil` and
+a string describing the error.
+
+If the `merge_stderr` option is specified in [spawn](#spawn), closing the
+`stderr` direction will return `nil` and the error string `"merged to stdout"`.
+
+Shutting down a direction when a light thread is waiting on it (such as during
+reading or writing) will abort the light thread and return `true`.
+
+Shutting down directions of an exited process will return `nil` and the error
+string `"closed"`.
+
+It is fine to shut down the same direction of the same stream multiple times;
+no side effects are to be expected.
+
+[Back to TOC](#table-of-contents)
+
+write
+-----
+**syntax:** *nbytes, err = proc:write(data)*
+
+**context:** *phases that support yielding*
+
+Writes data to the current sub-process's stdin stream.
+
+The `data` argument can be a string or a single level array-like Lua table with
+string values.
+
+This method is a synchronous and non-blocking operation that will not return
+until *all* the data has been flushed to the sub-process's stdin buffer, or
+an error occurs.
+
+In case of success, it returns the total number of bytes that have been sent.
+Otherwise, it returns `nil` and a string describing the error.
+
+The timeout threshold of this `write` operation can be controlled by the
+[set_timeouts](#set_timeouts) method. The default timeout threshold is 10
+seconds.
+
+When a timeout occurs, the data may be partially written into the sub-process's
+stdin buffer and read by the sub-process.
+
+Only one light thread is allowed to write to the sub-process at a time. If
+another light thread tries to write to it, this method will return `nil` and
+the error string `"pipe busy writing"`.
+
+If the `write` operation is aborted by the [shutdown](#shutdown) method,
+it will return `nil` and the error string `"aborted"`.
+
+Writing to an exited sub-process will return `nil` and the error string
+`"closed"`.
+
+[Back to TOC](#table-of-contents)
+
+stderr_read_all
+---------------
+**syntax:** *data, err, partial = proc:stderr_read_all()*
+
+**context:** *phases that support yielding*
+
+Reads all data from the current sub-process's stderr stream until it is closed.
+
+This method is a synchronous and non-blocking operation, just like the
+[write](#write) method.
+
+The timeout threshold of this reading operation can be controlled by
+[set_timeouts](#set_timeouts). The default timeout is 10 seconds.
+
+In case of success, it returns the data received. Otherwise, it returns three
+values: `nil`, a string describing the error, and, optionally, the partial data
+received so far.
+
+When `merge_stderr` is specified in [spawn](#spawn), calling `stderr_read_all`
+will return `nil` and the error string `"merged to stdout"`.
+
+Only one light thread is allowed to read from a sub-process's stderr or stdout
+stream at a time. If another thread tries to read from the same stream, this
+method will return `nil` and the error string `"pipe busy reading"`.
+
+If the reading operation is aborted by the [shutdown](#shutdown) method,
+it will return `nil` and the error string `"aborted"`.
+
+Streams for stdout and stderr are separated, so at most two light threads may
+be reading from a sub-process at a time (one for each stream).
+
+The same way, a light thread may read from a stream while another light thread
+is writing to the sub-process stdin stream.
+
+Reading from an exited process's stream will return `nil` and the error string
+`"closed"`.
+
+[Back to TOC](#table-of-contents)
+
+stdout_read_all
+---------------
+**syntax:** *data, err, partial = proc:stdout_read_all()*
+
+**context:** *phases that support yielding*
+
+Similar to the [stderr_read_all](#stderr_read_all) method, but reading from the
+stdout stream of the sub-process.
+
+[Back to TOC](#table-of-contents)
+
+stderr_read_line
+----------------
+**syntax:** *data, err, partial = proc:stderr_read_line()*
+
+**context:** *phases that support yielding*
+
+Reads from stderr like [stderr_read_all](#stderr_read_all), but only reads a
+single line of data.
+
+When `merge_stderr` is specified in [spawn](#spawn), calling `stderr_read_line`
+will return `nil` plus the error string `"merged to stdout"`.
+
+When the data stream is truncated without a new-line character, it returns 3
+values: `nil`, the error string `"closed"`, and the partial data received so
+far.
+
+The line should be terminated by a `Line Feed` (LF) character (ASCII 10),
+optionally preceded by a `Carriage Return` (CR) character (ASCII 13). The CR
+and LF characters are not included in the returned line data.
+
+[Back to TOC](#table-of-contents)
+
+stdout_read_line
+----------------
+**syntax:** *data, err, partial = proc:stdout_read_line()*
+
+**context:** *phases that support yielding*
+
+Similar to [stderr_read_line](#stderr_read_line), but reading from the
+stdout stream of the sub-process.
+
+[Back to TOC](#table-of-contents)
+
+stderr_read_bytes
+-----------------
+**syntax:** *data, err, partial = proc:stderr_read_bytes(len)*
+
+**context:** *phases that support yielding*
+
+Reads from stderr like [stderr_read_all](#stderr_read_all), but only reads the
+specified number of bytes.
+
+If `merge_stderr` is specified in [spawn](#spawn), calling `stderr_read_bytes`
+will return `nil` plus the error string `"merged to stdout"`.
+
+If the data stream is truncated (fewer bytes of data available than requested),
+this method returns 3 values: `nil`, the error string `"closed"`, and the
+partial data string received so far.
+
+[Back to TOC](#table-of-contents)
+
+stdout_read_bytes
+-----------------
+**syntax:** *data, err, partial = proc:stdout_read_bytes(len)*
+
+**context:** *phases that support yielding*
+
+Similar to [stderr_read_bytes](#stderr_read_bytes), but reading from the
+stdout stream of the sub-process.
+
+[Back to TOC](#table-of-contents)
+
+stderr_read_any
+---------------
+**syntax:** *data, err = proc:stderr_read_any(max)*
+
+**context:** *phases that support yielding*
+
+Reads from stderr like [stderr_read_all](#stderr_read_all), but returns
+immediately when any amount of data is received.
+
+At most `max` bytes are received.
+
+If `merge_stderr` is specified in [spawn](#spawn), calling `stderr_read_any`
+will return `nil` plus the error string `"merged to stdout"`.
+
+If the received data is more than `max` bytes, this method will return with
+exactly `max` bytes of data. The remaining data in the underlying receive
+buffer can be fetched with a subsequent reading operation.
+
+[Back to TOC](#table-of-contents)
+
+stdout_read_any
+---------------
+**syntax:** *data, err = proc:stdout_read_any(max)*
+
+**context:** *phases that support yielding*
+
+Similar to [stderr_read_any](#stderr_read_any), but reading from the stdout
+stream of the sub-process.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list
+is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for
+Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2018, by OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)

deps/src/lua-resty-core/lib/ngx/process.lua

@@ -0,0 +1,106 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http', 'stream')
+
+local ffi = require 'ffi'
+local errmsg = base.get_errmsg_ptr()
+local FFI_ERROR = base.FFI_ERROR
+local ffi_str = ffi.string
+local tonumber = tonumber
+local subsystem = ngx.config.subsystem
+
+if subsystem == 'http' then
+    require "resty.core.phase"  -- for ngx.get_phase
+end
+
+local ngx_phase = ngx.get_phase
+
+local process_type_names = {
+    [0 ]  = "single",
+    [1 ]  = "master",
+    [2 ]  = "signaller",
+    [3 ]  = "worker",
+    [4 ]  = "helper",
+    [99]  = "privileged agent",
+}
+
+
+local C = ffi.C
+local _M = { version = base.version }
+
+local ngx_lua_ffi_enable_privileged_agent
+local ngx_lua_ffi_get_process_type
+local ngx_lua_ffi_process_signal_graceful_exit
+local ngx_lua_ffi_master_pid
+
+if subsystem == 'http' then
+    ffi.cdef[[
+        int ngx_http_lua_ffi_enable_privileged_agent(char **err);
+        int ngx_http_lua_ffi_get_process_type(void);
+        void ngx_http_lua_ffi_process_signal_graceful_exit(void);
+        int ngx_http_lua_ffi_master_pid(void);
+    ]]
+
+    ngx_lua_ffi_enable_privileged_agent =
+        C.ngx_http_lua_ffi_enable_privileged_agent
+    ngx_lua_ffi_get_process_type = C.ngx_http_lua_ffi_get_process_type
+    ngx_lua_ffi_process_signal_graceful_exit =
+        C.ngx_http_lua_ffi_process_signal_graceful_exit
+    ngx_lua_ffi_master_pid = C.ngx_http_lua_ffi_master_pid
+
+else
+    ffi.cdef[[
+        int ngx_stream_lua_ffi_enable_privileged_agent(char **err);
+        int ngx_stream_lua_ffi_get_process_type(void);
+        void ngx_stream_lua_ffi_process_signal_graceful_exit(void);
+        int ngx_stream_lua_ffi_master_pid(void);
+    ]]
+
+    ngx_lua_ffi_enable_privileged_agent =
+        C.ngx_stream_lua_ffi_enable_privileged_agent
+    ngx_lua_ffi_get_process_type = C.ngx_stream_lua_ffi_get_process_type
+    ngx_lua_ffi_process_signal_graceful_exit =
+        C.ngx_stream_lua_ffi_process_signal_graceful_exit
+    ngx_lua_ffi_master_pid = C.ngx_stream_lua_ffi_master_pid
+end
+
+
+function _M.type()
+    local typ = ngx_lua_ffi_get_process_type()
+    return process_type_names[tonumber(typ)]
+end
+
+
+function _M.enable_privileged_agent()
+    if ngx_phase() ~= "init" then
+        return nil, "API disabled in the current context"
+    end
+
+    local rc = ngx_lua_ffi_enable_privileged_agent(errmsg)
+
+    if rc == FFI_ERROR then
+        return nil, ffi_str(errmsg[0])
+    end
+
+    return true
+end
+
+
+function _M.signal_graceful_exit()
+    ngx_lua_ffi_process_signal_graceful_exit()
+end
+
+
+function _M.get_master_pid()
+    local pid = ngx_lua_ffi_master_pid()
+    if pid == FFI_ERROR then
+        return nil
+    end
+
+    return tonumber(pid)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/process.md

@@ -0,0 +1,230 @@
+Name
+====
+
+`ngx.process` - manage the nginx processes for OpenResty/ngx_lua.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Functions](#functions)
+    * [type](#type)
+    * [enable_privileged_agent](#enable_privileged_agent)
+    * [signal_graceful_exit](#signal_graceful_exit)
+    * [get_master_pid](#get_master_pid)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+The API is still in flux and may change in the future without notice.
+
+Synopsis
+========
+
+Enables privileged agent process, gets process type, and then gets the master process PID:
+
+```nginx
+# http config
+init_by_lua_block {
+    local process = require "ngx.process"
+
+    -- enables privileged agent process
+    local ok, err = process.enable_privileged_agent()
+    if not ok then
+        ngx.log(ngx.ERR, "enables privileged agent failed error:", err)
+    end
+
+    -- output process type
+    ngx.log(ngx.INFO, "process type: ", process.type())
+}
+
+init_worker_by_lua_block {
+    local process = require "ngx.process"
+    ngx.log(ngx.INFO, "process type: ", process.type())
+}
+
+server {
+    # ...
+    location = /t {
+        content_by_lua_block {
+            local process = require "ngx.process"
+            ngx.say("process type: ", process.type())
+            ngx.say("master process pid: ", process.get_master_pid() or "-")
+        }
+    }
+}
+
+```
+
+The example config above produces an output to `error.log` when
+server starts:
+
+```
+[lua] init_by_lua:11: process type: master
+[lua] init_worker_by_lua:3: process type: privileged agent
+[lua] init_worker_by_lua:3: process type: worker
+```
+
+The example location above produces the following response body:
+
+```
+process type: worker
+master process pid: 8261
+```
+
+[Back to TOC](#table-of-contents)
+
+Functions
+=========
+
+type
+----
+**syntax:** *type_name = process_module.type()*
+
+**context:** *any*
+
+Returns the type of the current Nginx process. Depending on the calling context
+and current process, the type can be one of:
+
+* `master`: returned when this function is called from within the master
+  process
+* `worker`: returned when this function is called from within a worker process
+* `single`: returned when Nginx is running in the single process mode
+* `signaller`: returned when Nginx is running as a signaller process
+* `privileged agent`: returned when this funtion is called from within a
+  privileged agent process
+
+For example:
+
+```lua
+local process = require "ngx.process"
+ngx.say("process type:", process.type())   -- RESPONSE: worker
+```
+
+[Back to TOC](#table-of-contents)
+
+enable_privileged_agent
+-----------------------
+**syntax:** *ok, err = process_module.enable_privileged_agent()*
+
+**context:** *init_by_lua**
+
+Enables the privileged agent process in Nginx.
+
+The privileged agent process does not listen on any virtual server ports like those worker processes.
+And it uses the same system account as the nginx master process, which is usually a privileged account
+like `root`.
+
+The `init_worker_by_lua*` directive handler still runs in the privileged agent process. And one can
+use the [type](#type) function provided by this module to check if the current process is a privileged
+agent.
+
+In case of failures, returns `nil` and a string describing the error.
+
+[Back to TOC](#table-of-contents)
+
+signal_graceful_exit
+--------------------
+**syntax:** *process_module.signal_graceful_exit()*
+
+**context:** *any*
+
+Signals the *current* nginx (worker) process to quit gracefully, i.e., after all the timers have expired (in time or expired prematurely).
+
+Note that this API function simply sets the nginx global C variable `ngx_quit` to signal the nginx event
+loop directly. No UNIX signals or IPC are involved here.
+
+WARNING: the official NGINX core does not perform the graceful exiting procedure when the [master_process](http://nginx.org/r/master_process)
+directive is turned `off`. The OpenResty's NGINX core has a
+[custom patch](https://github.com/openresty/openresty/blob/master/patches/nginx-1.11.2-single_process_graceful_exit.patch)
+applied, which fixes this issue.
+
+[Back to TOC](#table-of-contents)
+
+get_master_pid
+--------------
+**syntax:** *pid = process_module.get_master_pid()*
+
+**context:** *any*
+
+Returns a number value for the nginx master process's process ID (or PID).
+
+This function requires NGINX 1.13.8+ cores to work properly. Otherwise it returns `nil`.
+
+This feature first appeared in lua-resty-core v0.1.14.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Yuansheng Wang <membphis@gmail.com> (membphis), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)
+

deps/src/lua-resty-core/lib/ngx/re.lua

@@ -0,0 +1,318 @@
+-- I hereby assign copyright in this code to the lua-resty-core project,
+-- to be licensed under the same terms as the rest of the code.
+
+
+local base = require "resty.core.base"
+local ffi = require 'ffi'
+local bit = require "bit"
+local core_regex = require "resty.core.regex"
+
+
+if core_regex.no_pcre then
+    error("no support for 'ngx.re' module: OpenResty was " ..
+          "compiled without PCRE support", 3)
+end
+
+
+local C = ffi.C
+local ffi_str = ffi.string
+local sub = string.sub
+local error = error
+local type = type
+local band = bit.band
+local new_tab = base.new_tab
+local tostring = tostring
+local math_max = math.max
+local math_min = math.min
+local is_regex_cache_empty = core_regex.is_regex_cache_empty
+local re_match_compile = core_regex.re_match_compile
+local destroy_compiled_regex = core_regex.destroy_compiled_regex
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local FFI_OK = base.FFI_OK
+local subsystem = ngx.config.subsystem
+
+
+local MAX_ERR_MSG_LEN        = 128
+local FLAG_DFA               = 0x02
+local PCRE_ERROR_NOMATCH     = -1
+local DEFAULT_SPLIT_RES_SIZE = 4
+
+
+local split_ctx = new_tab(0, 1)
+local ngx_lua_ffi_set_jit_stack_size
+local ngx_lua_ffi_exec_regex
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+int ngx_http_lua_ffi_set_jit_stack_size(int size, unsigned char *errstr,
+    size_t *errstr_size);
+    ]]
+
+    ngx_lua_ffi_exec_regex = C.ngx_http_lua_ffi_exec_regex
+    ngx_lua_ffi_set_jit_stack_size = C.ngx_http_lua_ffi_set_jit_stack_size
+
+elseif subsystem == 'stream' then
+    ffi.cdef[[
+int ngx_stream_lua_ffi_set_jit_stack_size(int size, unsigned char *errstr,
+    size_t *errstr_size);
+    ]]
+
+    ngx_lua_ffi_exec_regex = C.ngx_stream_lua_ffi_exec_regex
+    ngx_lua_ffi_set_jit_stack_size = C.ngx_stream_lua_ffi_set_jit_stack_size
+end
+
+
+local _M = { version = base.version }
+
+
+local function re_split_helper(subj, compiled, compile_once, flags, ctx)
+    local rc
+    do
+        local pos = math_max(ctx.pos, 0)
+
+        rc = ngx_lua_ffi_exec_regex(compiled, flags, subj, #subj, pos)
+    end
+
+    if rc == PCRE_ERROR_NOMATCH then
+        return nil, nil, nil
+    end
+
+    if rc < 0 then
+        if not compile_once then
+            destroy_compiled_regex(compiled)
+        end
+        return nil, nil, nil, "pcre_exec() failed: " .. rc
+    end
+
+    if rc == 0 then
+        if band(flags, FLAG_DFA) == 0 then
+            if not compile_once then
+                destroy_compiled_regex(compiled)
+            end
+            return nil, nil, nil, "capture size too small"
+        end
+
+        rc = 1
+    end
+
+    local caps = compiled.captures
+    local ncaps = compiled.ncaptures
+
+    local from = caps[0]
+    local to = caps[1]
+
+    if from < 0 or to < 0 then
+        return nil, nil, nil
+    end
+
+    if from == to then
+        -- empty match, skip to next char
+        ctx.pos = to + 1
+
+    else
+        ctx.pos = to
+    end
+
+    -- convert to Lua string indexes
+
+    from = from + 1
+    to = to + 1
+
+    -- retrieve the first sub-match capture if any
+
+    if ncaps > 0 and rc > 1 then
+        return from, to, sub(subj, caps[2] + 1, caps[3])
+    end
+
+    return from, to
+end
+
+
+function _M.split(subj, regex, opts, ctx, max, res)
+    -- we need to cast this to strings to avoid exceptions when they are
+    -- something else.
+    -- needed because of further calls to string.sub in this function.
+    subj = tostring(subj)
+
+    if not ctx then
+        ctx = split_ctx
+        ctx.pos = 1 -- set or reset upvalue field
+
+    elseif not ctx.pos then
+        -- ctx provided by user but missing pos field
+        ctx.pos = 1
+    end
+
+    max = max or 0
+
+    if not res then
+        -- limit the initial arr_n size of res to a reasonable value
+        -- 0 < narr <= DEFAULT_SPLIT_RES_SIZE
+        local narr = DEFAULT_SPLIT_RES_SIZE
+        if max > 0 then
+            -- the user specified a valid max limiter if max > 0
+            narr = math_min(narr, max)
+        end
+
+        res = new_tab(narr, 0)
+
+    elseif type(res) ~= "table" then
+        error("res is not a table", 2)
+    end
+
+    local len = #subj
+    if ctx.pos > len then
+        res[1] = nil
+        return res
+    end
+
+    -- compile regex
+
+    local compiled, compile_once, flags = re_match_compile(regex, opts)
+    if compiled == nil then
+        -- compiled_once holds the error string
+        return nil, compile_once
+    end
+
+    local sub_idx = ctx.pos
+    local res_idx = 0
+    local last_empty_match
+
+    -- update to split_helper PCRE indexes
+    ctx.pos = sub_idx - 1
+
+    -- splitting: with and without a max limiter
+
+    if max > 0 then
+        local count = 1
+
+        while count < max do
+            local from, to, capture, err = re_split_helper(subj, compiled,
+                                                compile_once, flags, ctx)
+            if err then
+                return nil, err
+            end
+
+            if not from then
+                break
+            end
+
+            if last_empty_match then
+                sub_idx = last_empty_match
+            end
+
+            if from == to then
+                last_empty_match = from
+            end
+
+            if from > sub_idx or not last_empty_match then
+                count = count + 1
+                res_idx = res_idx + 1
+                res[res_idx] = sub(subj, sub_idx, from - 1)
+
+                if capture then
+                    res_idx = res_idx + 1
+                    res[res_idx] = capture
+                end
+
+                sub_idx = to
+
+                if sub_idx > len then
+                    break
+                end
+            end
+        end
+
+    else
+        while true do
+            local from, to, capture, err = re_split_helper(subj, compiled,
+                                                compile_once, flags, ctx)
+            if err then
+                return nil, err
+            end
+
+            if not from then
+                break
+            end
+
+            if last_empty_match then
+                sub_idx = last_empty_match
+            end
+
+            if from == to then
+                last_empty_match = from
+            end
+
+            if from > sub_idx or not last_empty_match then
+                res_idx = res_idx + 1
+                res[res_idx] = sub(subj, sub_idx, from - 1)
+
+                if capture then
+                    res_idx = res_idx + 1
+                    res[res_idx] = capture
+                end
+
+                sub_idx = to
+
+                if sub_idx > len then
+                    break
+                end
+            end
+        end
+
+    end
+
+    if not compile_once then
+        destroy_compiled_regex(compiled)
+    end
+
+    -- trailing nil for non-cleared res tables
+
+    -- delete empty trailing ones (without max)
+    if max <= 0 and sub_idx > len then
+        for ety_idx = res_idx, 1, -1 do
+            if res[ety_idx] ~= "" then
+                res_idx = ety_idx
+                break
+            end
+
+            res[ety_idx] = nil
+        end
+    else
+        res_idx = res_idx + 1
+        res[res_idx] = sub(subj, sub_idx)
+    end
+
+    res[res_idx + 1] = nil
+
+    return res
+end
+
+
+function _M.opt(option, value)
+    if option == "jit_stack_size" then
+        if not is_regex_cache_empty() then
+            error("changing jit stack size is not allowed when some " ..
+                  "regexs have already been compiled and cached", 2)
+        end
+
+        local errbuf = get_string_buf(MAX_ERR_MSG_LEN)
+        local sizep = get_size_ptr()
+        sizep[0] = MAX_ERR_MSG_LEN
+
+        local rc = ngx_lua_ffi_set_jit_stack_size(value, errbuf, sizep)
+
+        if rc == FFI_OK then
+            return
+        end
+
+        error(ffi_str(errbuf, sizep[0]), 2)
+    end
+
+    error("unrecognized option name", 2)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/re.md

@@ -0,0 +1,249 @@
+Name
+====
+
+ngx.re - Lua API for convenience utilities for `ngx.re`.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [split](#split)
+    * [opt](#opt)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+Synopsis
+========
+
+```lua
+local ngx_re = require "ngx.re"
+
+-- split
+local res, err = ngx_re.split("a,b,c,d", ",")
+--> res is now {"a", "b", "c", "d"}
+
+-- opt
+ngx_re.opt("jit_stack_size", 128 * 1024)
+--> the PCRE jit stack can now handle more complex regular expressions
+```
+
+[Back to TOC](#table-of-contents)
+
+Description
+===========
+
+This Lua module provides a Lua API which implements convenience utilities for
+the `ngx.re` API.
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+All the methods of this module are static (or module-level). That is, you do
+not need an object (or instance) to call these methods.
+
+[Back to TOC](#table-of-contents)
+
+split
+-----
+**syntax:** *res, err = ngx_re.split(subject, regex, options?, ctx?, max?, res?)*
+
+Splits the `subject` string using the Perl compatible regular expression
+`regex` with the optional `options`.
+
+This function returns a Lua (array) table (with integer keys) containing the
+split values.
+
+In case of error, `nil` will be returned as well as a string describing the
+error.
+
+When `regex` contains a sub-match capturing group, and when such a match is
+found, the first submatch capture will be inserted in between each split
+value, like so:
+
+```lua
+local ngx_re = require "ngx.re"
+
+local res, err = ngx_re.split("a,b,c,d", "(,)")
+-- res is now {"a", ",", "b", ",", "c", ",", "d"}
+```
+
+When `regex` is empty string `""`, the `subject` will be split into chars,
+like so:
+
+```lua
+local ngx_re = require "ngx.re"
+
+local res, err = ngx_re.split("abcd", "")
+-- res is now {"a", "b", "c", "d"}
+```
+
+The optional `ctx` table argument can be a Lua table holding an optional `pos`
+field. When the `pos` field in the `ctx` table argument is specified,
+`ngx_re.split` will start splitting the `subject` from that index:
+
+```lua
+local ngx_re = require "ngx.re"
+
+local res, err = ngx_re.split("a,b,c,d", ",", nil, {pos = 5})
+-- res is now {"c", "d"}
+```
+
+The optional `max` argument is a number that when specified, will prevent
+`ngx_re.split` from adding more than `max` matches to the `res` array:
+
+```lua
+local ngx_re = require "ngx.re"
+
+local res, err = ngx_re.split("a,b,c,d", ",", nil, nil, 3)
+-- res is now {"a", "b", "c,d"}
+```
+
+Specifying `max <= 0` disables this behavior, meaning that the number of
+results won't be limited.
+
+The optional 6th argument `res` can be a table that `ngx_re.split` will re-use
+to hold the results instead of creating a new one, which can improve
+performance in hot code paths. It is used like so:
+
+```lua
+local ngx_re = require "ngx.re"
+
+local my_table = {"hello world"}
+
+local res, err = ngx_re.split("a,b,c,d", ",", nil, nil, nil, my_table)
+-- res/my_table is now {"a", "b", "c", "d"}
+```
+
+When provided with a `res` table, `ngx_re.split` won't clear the table
+for performance reasons, but will rather insert a trailing `nil` value
+when the split is completed:
+
+```lua
+local ngx_re = require "ngx.re"
+
+local my_table = {"W", "X", "Y", "Z"}
+
+local res, err = ngx_re.split("a,b", ",", nil, nil, nil, my_table)
+-- res/my_table is now {"a", "b", nil, "Z"}
+```
+
+When the trailing `nil` is not enough for your purpose, you should
+clear the table yourself before feeding it into the `split` function.
+
+[Back to TOC](#table-of-contents)
+
+opt
+-----
+**syntax:** *ngx_re.opt(option, value)*
+
+Allows changing of regex settings. Currently, it can only change the
+`jit_stack_size` of the PCRE engine, like so:
+
+```nginx
+
+ init_by_lua_block { require "ngx.re".opt("jit_stack_size", 200 * 1024) }
+
+ server {
+     location /re {
+         content_by_lua_block {
+             -- full regex and string are taken from https://github.com/JuliaLang/julia/issues/8278
+             local very_long_string = [[71.163.72.113 - - [30/Jul/2014:16:40:55 -0700] ...]]
+             local very_complicated_regex = [[([\d\.]+) ([\w.-]+) ([\w.-]+) (\[.+\]) ...]]
+             local from, to, err = ngx.re.find(very_long_string, very_complicated_regex, "jo")
+
+             -- with the regular jit_stack_size, we would get the error 'pcre_exec() failed: -27'
+             -- instead, we get a match
+             ngx.print(from .. "-" .. to) -- prints '1-1563'
+         }
+     }
+ }
+```
+
+The `jit_stack_size` cannot be set to a value lower than PCRE's default of 32K.
+
+This method requires the PCRE library enabled in Nginx.
+
+This feature was first introduced in the `v0.1.12` release.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list
+is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for
+Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Thibault Charbonnier - ([@thibaultcha](https://github.com/thibaultcha))
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2016-2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)

deps/src/lua-resty-core/lib/ngx/req.lua

@@ -0,0 +1,20 @@
+-- Copyright (C) by OpenResty Inc.
+
+
+local base = require "resty.core.base"
+base.allows_subsystem("http")
+
+
+local core_request = require "resty.core.request"
+local set_req_header = core_request.set_req_header
+
+
+local _M = { version = base.version }
+
+
+function _M.add_header(key, value)
+    set_req_header(key, value, false)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/req.md

@@ -0,0 +1,139 @@
+Name
+====
+
+ngx.req - Lua API for HTTP request handling.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [add_header](#add_header)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+Synopsis
+========
+
+```lua
+local ngx_req = require "ngx.req"
+
+-- add_header
+ngx_req.add_header("Foo", "bar")
+ngx_req.add_header("Foo", "baz")
+
+--> there will be two new headers in the HTTP request:
+--> Foo: bar and Foo: baz
+```
+
+[Back to TOC](#table-of-contents)
+
+Description
+===========
+
+This module provides a Lua API to handle HTTP requests.
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+All methods provided by this module are static (or module-level). That is, you
+do not need an object (or instance) to call these methods.
+
+[Back to TOC](#table-of-contents)
+
+add_header
+----------
+**syntax:** *ngx_req.add_header(header_name, header_value)*
+
+**context:** *set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua**
+
+This method adds the specified header and its value to the current
+request. It works similarly as
+[ngx.req.set_header](https://github.com/openresty/lua-nginx-module#ngxreqset_header),
+with the exception that when the header already exists, the specified value(s)
+will be appended instead of overriden.
+
+The first argument `header_name` must be a non-empty string.
+
+When the specified `header_name` is a builtin header (e.g. `User-Agent`), this
+method will override its values.
+
+The `header_value` argument can either be a string or a non-empty, array-like
+table. A `nil` or empty table value will cause this function to throw an error.
+
+This feature was first introduced in the `v0.1.18` release.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list
+is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for
+Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2016-2019, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* library [lua-resty-core](https://github.com/openresty/lua-resty-core)
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)
+

deps/src/lua-resty-core/lib/ngx/resp.lua

@@ -0,0 +1,18 @@
+-- Copyright (C) Yichun Zhang. All rights reserved.
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http')
+local core_response = require "resty.core.response"
+local set_resp_header = core_response.set_resp_header
+
+
+local _M = { version = base.version }
+
+
+function _M.add_header(key, value)
+    set_resp_header(nil, key, value, true)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/resp.md

@@ -0,0 +1,133 @@
+Name
+====
+
+ngx.resp - Lua API for HTTP response handling.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [add_header](#add_header)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is currently considered experimental.
+
+Synopsis
+========
+
+```lua
+local ngx_resp = require "ngx.resp"
+
+-- add_header
+ngx_resp.add_header("Foo", "bar")
+ngx_resp.add_header("Foo", "baz")
+--> there will be two new headers in HTTP response:
+--> Foo: bar and Foo: baz
+```
+
+[Back to TOC](#table-of-contents)
+
+Description
+===========
+
+This Lua module provides Lua API which could be used to handle HTTP response.
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+All the methods of this module are static (or module-level). That is, you do
+not need an object (or instance) to call these methods.
+
+[Back to TOC](#table-of-contents)
+
+add_header
+----------
+**syntax:** *ngx_resp.add_header(header_name, header_value)*
+
+This function adds specified header with corresponding value to the response of
+current request. The `header_value` could be either a string or a table.
+
+The `ngx.resp.add_header` works mostly like:
+* [ngx.header.HEADER](https://github.com/openresty/lua-nginx-module#ngxheaderheader)
+* Nginx's [add_header](http://nginx.org/en/docs/http/ngx_http_headers_module.html#add_header) directive.
+
+However, unlike `ngx.header.HEADER`, this method appends new header to the old
+one instead of overriding it.
+
+Unlike `add_header` directive, this method will override the builtin header
+instead of appending it.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list
+is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for
+Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2018, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)
+

deps/src/lua-resty-core/lib/ngx/semaphore.lua

@@ -0,0 +1,193 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+-- Copyright (C) cuiweixie
+-- I hereby assign copyright in this code to the lua-resty-core project,
+-- to be licensed under the same terms as the rest of the code.
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http', 'stream')
+
+
+local ffi = require 'ffi'
+local FFI_OK = base.FFI_OK
+local FFI_ERROR = base.FFI_ERROR
+local FFI_DECLINED = base.FFI_DECLINED
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local ffi_gc = ffi.gc
+local C = ffi.C
+local type = type
+local error = error
+local tonumber = tonumber
+local get_request = base.get_request
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local setmetatable = setmetatable
+local co_yield = coroutine._yield
+local ERR_BUF_SIZE = 128
+local subsystem = ngx.config.subsystem
+
+
+local errmsg = base.get_errmsg_ptr()
+local psem
+local ngx_lua_ffi_sema_new
+local ngx_lua_ffi_sema_post
+local ngx_lua_ffi_sema_count
+local ngx_lua_ffi_sema_wait
+local ngx_lua_ffi_sema_gc
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+        struct ngx_http_lua_sema_s;
+        typedef struct ngx_http_lua_sema_s ngx_http_lua_sema_t;
+
+        int ngx_http_lua_ffi_sema_new(ngx_http_lua_sema_t **psem,
+            int n, char **errmsg);
+
+        int ngx_http_lua_ffi_sema_post(ngx_http_lua_sema_t *sem, int n);
+
+        int ngx_http_lua_ffi_sema_count(ngx_http_lua_sema_t *sem);
+
+        int ngx_http_lua_ffi_sema_wait(ngx_http_request_t *r,
+            ngx_http_lua_sema_t *sem, int wait_ms,
+            unsigned char *errstr, size_t *errlen);
+
+        void ngx_http_lua_ffi_sema_gc(ngx_http_lua_sema_t *sem);
+    ]]
+
+
+    psem = ffi_new("ngx_http_lua_sema_t *[1]")
+    ngx_lua_ffi_sema_new = C.ngx_http_lua_ffi_sema_new
+    ngx_lua_ffi_sema_post = C.ngx_http_lua_ffi_sema_post
+    ngx_lua_ffi_sema_count = C.ngx_http_lua_ffi_sema_count
+    ngx_lua_ffi_sema_wait = C.ngx_http_lua_ffi_sema_wait
+    ngx_lua_ffi_sema_gc = C.ngx_http_lua_ffi_sema_gc
+
+elseif subsystem == 'stream' then
+    ffi.cdef[[
+        struct ngx_stream_lua_sema_s;
+        typedef struct ngx_stream_lua_sema_s ngx_stream_lua_sema_t;
+
+        int ngx_stream_lua_ffi_sema_new(ngx_stream_lua_sema_t **psem,
+            int n, char **errmsg);
+
+        int ngx_stream_lua_ffi_sema_post(ngx_stream_lua_sema_t *sem, int n);
+
+        int ngx_stream_lua_ffi_sema_count(ngx_stream_lua_sema_t *sem);
+
+        int ngx_stream_lua_ffi_sema_wait(ngx_stream_lua_request_t *r,
+            ngx_stream_lua_sema_t *sem, int wait_ms,
+            unsigned char *errstr, size_t *errlen);
+
+        void ngx_stream_lua_ffi_sema_gc(ngx_stream_lua_sema_t *sem);
+    ]]
+
+
+    psem = ffi_new("ngx_stream_lua_sema_t *[1]")
+    ngx_lua_ffi_sema_new = C.ngx_stream_lua_ffi_sema_new
+    ngx_lua_ffi_sema_post = C.ngx_stream_lua_ffi_sema_post
+    ngx_lua_ffi_sema_count = C.ngx_stream_lua_ffi_sema_count
+    ngx_lua_ffi_sema_wait = C.ngx_stream_lua_ffi_sema_wait
+    ngx_lua_ffi_sema_gc = C.ngx_stream_lua_ffi_sema_gc
+end
+
+
+local _M = { version = base.version }
+local mt = { __index = _M }
+
+
+function _M.new(n)
+    n = tonumber(n) or 0
+    if n < 0 then
+        error("no negative number", 2)
+    end
+
+    local ret = ngx_lua_ffi_sema_new(psem, n, errmsg)
+    if ret == FFI_ERROR then
+        return nil, ffi_str(errmsg[0])
+    end
+
+    local sem = psem[0]
+
+    ffi_gc(sem, ngx_lua_ffi_sema_gc)
+
+    return setmetatable({ sem = sem }, mt)
+end
+
+
+function _M.wait(self, seconds)
+    if type(self) ~= "table" or type(self.sem) ~= "cdata" then
+        error("not a semaphore instance", 2)
+    end
+
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local milliseconds = tonumber(seconds) * 1000
+    if milliseconds < 0 then
+        error("no negative number", 2)
+    end
+
+    local cdata_sem = self.sem
+
+    local err = get_string_buf(ERR_BUF_SIZE)
+    local errlen = get_size_ptr()
+    errlen[0] = ERR_BUF_SIZE
+
+    local ret = ngx_lua_ffi_sema_wait(r, cdata_sem,
+                                      milliseconds, err, errlen)
+
+    if ret == FFI_ERROR then
+        return nil, ffi_str(err, errlen[0])
+    end
+
+    if ret == FFI_OK then
+        return true
+    end
+
+    if ret == FFI_DECLINED then
+        return nil, "timeout"
+    end
+
+    -- Note: we cannot use the tail-call form here since we
+    -- might need the current function call's activation
+    -- record to hold the reference to our semaphore object
+    -- to prevent it from getting GC'd prematurely.
+    local ok
+    ok, err = co_yield()
+    return ok, err
+end
+
+
+function _M.post(self, n)
+    if type(self) ~= "table" or type(self.sem) ~= "cdata" then
+        error("not a semaphore instance", 2)
+    end
+
+    local cdata_sem = self.sem
+
+    local num = n and tonumber(n) or 1
+    if num < 1 then
+        error("positive number required", 2)
+    end
+
+    -- always return NGX_OK
+    ngx_lua_ffi_sema_post(cdata_sem, num)
+
+    return true
+end
+
+
+function _M.count(self)
+    if type(self) ~= "table" or type(self.sem) ~= "cdata" then
+        error("not a semaphore instance", 2)
+    end
+
+    return ngx_lua_ffi_sema_count(self.sem)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/semaphore.md

@@ -0,0 +1,356 @@
+Name
+====
+
+ngx.semaphore - light thread semaphore for OpenResty/ngx_lua.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+    * [Synchronizing threads in the same context](#synchronizing-threads-in-the-same-context)
+    * [Synchronizing threads in different contexts](#synchronizing-threads-in-different-contexts)
+* [Description](#description)
+* [Methods](#methods)
+    * [new](#new)
+    * [post](#post)
+    * [wait](#wait)
+    * [count](#count)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is production ready.
+
+Synopsis
+========
+
+Synchronizing threads in the same context
+-----------------------------------------
+
+```nginx
+location = /t {
+    content_by_lua_block {
+        local semaphore = require "ngx.semaphore"
+        local sema = semaphore.new()
+
+        local function handler()
+            ngx.say("sub thread: waiting on sema...")
+
+            local ok, err = sema:wait(1)  -- wait for a second at most
+            if not ok then
+                ngx.say("sub thread: failed to wait on sema: ", err)
+            else
+                ngx.say("sub thread: waited successfully.")
+            end
+        end
+
+        local co = ngx.thread.spawn(handler)
+
+        ngx.say("main thread: sleeping for a little while...")
+
+        ngx.sleep(0.1)  -- wait a bit
+
+        ngx.say("main thread: posting to sema...")
+
+        sema:post(1)
+
+        ngx.say("main thread: end.")
+    }
+}
+```
+
+The example location above produces a response output like this:
+
+```
+sub thread: waiting on sema...
+main thread: sleeping for a little while...
+main thread: posting to sema...
+main thread: end.
+sub thread: waited successfully.
+```
+
+[Back to TOC](#table-of-contents)
+
+Synchronizing threads in different contexts
+-------------------------------------------
+
+```nginx
+location = /t {
+    content_by_lua_block {
+        local semaphore = require "ngx.semaphore"
+        local sema = semaphore.new()
+
+        local outputs = {}
+        local i = 1
+
+        local function out(s)
+            outputs[i] = s
+            i = i + 1
+        end
+
+        local function handler()
+            out("timer thread: sleeping for a little while...")
+
+            ngx.sleep(0.1)  -- wait a bit
+
+            out("timer thread: posting on sema...")
+
+            sema:post(1)
+        end
+
+        assert(ngx.timer.at(0, handler))
+
+        out("main thread: waiting on sema...")
+
+        local ok, err = sema:wait(1)  -- wait for a second at most
+        if not ok then
+            out("main thread: failed to wait on sema: ", err)
+        else
+            out("main thread: waited successfully.")
+        end
+
+        out("main thread: end.")
+
+        ngx.say(table.concat(outputs, "\n"))
+    }
+}
+```
+
+The example location above produces a response body like this
+
+```
+main thread: waiting on sema...
+timer thread: sleeping for a little while...
+timer thread: posting on sema...
+main thread: waited successfully.
+main thread: end.
+```
+
+The same applies to different request contexts as long as these requests are served
+by the same nginx worker process.
+
+[Back to TOC](#table-of-contents)
+
+Description
+===========
+
+This module provides an efficient semaphore API for the OpenResty/ngx_lua module. With
+semaphores, "light threads" (created by [ngx.thread.spawn](https://github.com/openresty/lua-nginx-module#ngxthreadspawn),
+[ngx.timer.at](https://github.com/openresty/lua-nginx-module#ngxtimerat), and etc.) can
+synchronize among each other very efficiently without constant polling and sleeping.
+
+"Light threads" in different contexts (like in different requests) can share the same
+semaphore instance as long as these "light threads" reside in the same NGINX worker
+process and the [lua_code_cache](https://github.com/openresty/lua-nginx-module#lua_code_cache)
+directive is turned on (which is the default). For inter-process "light thread" synchronization,
+it is recommended to use the [lua-resty-lock](https://github.com/openresty/lua-resty-lock) library instead
+(which is a bit less efficient than this semaphore API though).
+
+This semaphore API has a pure userland implementation which does not involve any system calls nor
+block any operating system threads. It works closely with the event model of NGINX without
+introducing any extra delay.
+
+Like other APIs provided by this `lua-resty-core` library, the LuaJIT FFI feature is required.
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+[Back to TOC](#table-of-contents)
+
+new
+---
+**syntax:** *sema, err = semaphore_module.new(n?)*
+
+**context:** *init_by_lua*, init_worker_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer.**
+
+Creates and returns a new semaphore instance that has `n` (default to `0`) resources.
+
+For example,
+
+```lua
+ local semaphore = require "ngx.semaphore"
+ local sema, err = semaphore.new()
+ if not sema then
+     ngx.say("create semaphore failed: ", err)
+ end
+```
+
+Often the semaphore object created is shared on the NGINX worker process by mounting in a custom Lua module, as
+documented below:
+
+https://github.com/openresty/lua-nginx-module#data-sharing-within-an-nginx-worker
+
+[Back to TOC](#table-of-contents)
+
+post
+--------
+**syntax:** *sema:post(n?)*
+
+**context:** *init_by_lua*, init_worker_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*, content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer.**
+
+Releases `n` (default to `1`) "resources" to the semaphore instance.
+
+This will not yield the current running "light thread".
+
+At most `n` "light threads" will be waken up when the current running "light thread" later yields (or terminates).
+
+```lua
+-- typically, we get the semaphore instance from upvalue or globally shared data
+-- See https://github.com/openresty/lua-nginx-module#data-sharing-within-an-nginx-worker
+
+local semaphore = require "ngx.semaphore"
+local sema = semaphore.new()
+
+sema:post(2)  -- releases 2 resources
+```
+
+[Back to TOC](#table-of-contents)
+
+wait
+----
+**syntax:** *ok, err = sema:wait(timeout)*
+
+**context:** *rewrite_by_lua*, access_by_lua*, content_by_lua*, ngx.timer.**
+
+Requests a resource from the semaphore instance.
+
+Returns `true` immediately when there is resources available for the current running "light thread".
+Otherwise the current "light thread" will enter the waiting queue and yield execution.
+The current "light thread" will be automatically waken up and the `wait` function call
+will return `true` when there is resources available for it, or return `nil` and a string describing
+the error in case of failure (like `"timeout"`).
+
+The `timeout` argument specifies the maximum time this function call should wait for (in seconds).
+
+When the `timeout` argument is 0, it means "no wait", that is, when there is no readily available
+"resources" for the current running "light thread", this `wait` function call returns immediately
+`nil` and the error string `"timeout"`.
+
+You can specify millisecond precision in the timeout value by using floating point numbers like 0.001 (which means 1ms).
+
+"Light threads" created by different contexts (like request handlers) can wait on the
+same semaphore instance without problem.
+
+See [Synopsis](#synopsis) for code examples.
+
+[Back to TOC](#table-of-contents)
+
+count
+--------
+**syntax:** *count = sema:count()*
+
+**context:** *init_by_lua*, init_worker_by_lua*, set_by_lua*, rewrite_by_lua*, access_by_lua*,
+content_by_lua*, header_filter_by_lua*, body_filter_by_lua*, log_by_lua*, ngx.timer.**
+
+Returns the number of resources readily available in the `sema` semaphore instance (if any).
+
+When the returned number is negative, it means the number of "light threads" waiting on
+this semaphore.
+
+Consider the following example,
+
+```lua
+local semaphore = require "ngx.semaphore"
+local sema = semaphore.new(0)
+
+ngx.say("count: ", sema:count())  -- count: 0
+
+local function handler(id)
+    local ok, err = sema:wait(1)
+    if not ok then
+        ngx.say("err: ", err)
+    else
+        ngx.say("wait success")
+    end
+end
+
+local co1 = ngx.thread.spawn(handler)
+local co2 = ngx.thread.spawn(handler)
+
+ngx.say("count: ", sema:count())  -- count: -2
+
+sema:post(1)
+
+ngx.say("count: ", sema:count())  -- count: -1
+
+sema:post(2)
+
+ngx.say("count: ", sema:count())  -- count: 1
+```
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Weixie Cui, Kugou Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2015-2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)
+

deps/src/lua-resty-core/lib/ngx/ssl.lua

@@ -0,0 +1,467 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http', 'stream')
+
+
+local ffi = require "ffi"
+local C = ffi.C
+local ffi_str = ffi.string
+local ffi_gc = ffi.gc
+local get_request = base.get_request
+local error = error
+local tonumber = tonumber
+local errmsg = base.get_errmsg_ptr()
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local FFI_DECLINED = base.FFI_DECLINED
+local FFI_OK = base.FFI_OK
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_ssl_set_der_certificate
+local ngx_lua_ffi_ssl_clear_certs
+local ngx_lua_ffi_ssl_set_der_private_key
+local ngx_lua_ffi_ssl_raw_server_addr
+local ngx_lua_ffi_ssl_server_port
+local ngx_lua_ffi_ssl_server_name
+local ngx_lua_ffi_ssl_raw_client_addr
+local ngx_lua_ffi_cert_pem_to_der
+local ngx_lua_ffi_priv_key_pem_to_der
+local ngx_lua_ffi_ssl_get_tls1_version
+local ngx_lua_ffi_parse_pem_cert
+local ngx_lua_ffi_parse_pem_priv_key
+local ngx_lua_ffi_set_cert
+local ngx_lua_ffi_set_priv_key
+local ngx_lua_ffi_free_cert
+local ngx_lua_ffi_free_priv_key
+local ngx_lua_ffi_ssl_verify_client
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_ssl_set_der_certificate(ngx_http_request_t *r,
+        const char *data, size_t len, char **err);
+
+    int ngx_http_lua_ffi_ssl_clear_certs(ngx_http_request_t *r, char **err);
+
+    int ngx_http_lua_ffi_ssl_set_der_private_key(ngx_http_request_t *r,
+        const char *data, size_t len, char **err);
+
+    int ngx_http_lua_ffi_ssl_raw_server_addr(ngx_http_request_t *r, char **addr,
+        size_t *addrlen, int *addrtype, char **err);
+
+    int ngx_http_lua_ffi_ssl_server_port(ngx_http_request_t *r,
+        unsigned short *server_port, char **err);
+
+    int ngx_http_lua_ffi_ssl_server_name(ngx_http_request_t *r, char **name,
+        size_t *namelen, char **err);
+
+    int ngx_http_lua_ffi_ssl_raw_client_addr(ngx_http_request_t *r, char **addr,
+        size_t *addrlen, int *addrtype, char **err);
+
+    int ngx_http_lua_ffi_cert_pem_to_der(const unsigned char *pem,
+        size_t pem_len, unsigned char *der, char **err);
+
+    int ngx_http_lua_ffi_priv_key_pem_to_der(const unsigned char *pem,
+        size_t pem_len, unsigned char *der, char **err);
+
+    int ngx_http_lua_ffi_ssl_get_tls1_version(ngx_http_request_t *r,
+        char **err);
+
+    void *ngx_http_lua_ffi_parse_pem_cert(const unsigned char *pem,
+        size_t pem_len, char **err);
+
+    void *ngx_http_lua_ffi_parse_pem_priv_key(const unsigned char *pem,
+        size_t pem_len, char **err);
+
+    int ngx_http_lua_ffi_set_cert(void *r, void *cdata, char **err);
+
+    int ngx_http_lua_ffi_set_priv_key(void *r, void *cdata, char **err);
+
+    void ngx_http_lua_ffi_free_cert(void *cdata);
+
+    void ngx_http_lua_ffi_free_priv_key(void *cdata);
+
+    int ngx_http_lua_ffi_ssl_verify_client(void *r,
+        void *cdata, int depth, char **err);
+    ]]
+
+    ngx_lua_ffi_ssl_set_der_certificate =
+        C.ngx_http_lua_ffi_ssl_set_der_certificate
+    ngx_lua_ffi_ssl_clear_certs = C.ngx_http_lua_ffi_ssl_clear_certs
+    ngx_lua_ffi_ssl_set_der_private_key =
+        C.ngx_http_lua_ffi_ssl_set_der_private_key
+    ngx_lua_ffi_ssl_raw_server_addr = C.ngx_http_lua_ffi_ssl_raw_server_addr
+    ngx_lua_ffi_ssl_server_port = C.ngx_http_lua_ffi_ssl_server_port
+    ngx_lua_ffi_ssl_server_name = C.ngx_http_lua_ffi_ssl_server_name
+    ngx_lua_ffi_ssl_raw_client_addr = C.ngx_http_lua_ffi_ssl_raw_client_addr
+    ngx_lua_ffi_cert_pem_to_der = C.ngx_http_lua_ffi_cert_pem_to_der
+    ngx_lua_ffi_priv_key_pem_to_der = C.ngx_http_lua_ffi_priv_key_pem_to_der
+    ngx_lua_ffi_ssl_get_tls1_version = C.ngx_http_lua_ffi_ssl_get_tls1_version
+    ngx_lua_ffi_parse_pem_cert = C.ngx_http_lua_ffi_parse_pem_cert
+    ngx_lua_ffi_parse_pem_priv_key = C.ngx_http_lua_ffi_parse_pem_priv_key
+    ngx_lua_ffi_set_cert = C.ngx_http_lua_ffi_set_cert
+    ngx_lua_ffi_set_priv_key = C.ngx_http_lua_ffi_set_priv_key
+    ngx_lua_ffi_free_cert = C.ngx_http_lua_ffi_free_cert
+    ngx_lua_ffi_free_priv_key = C.ngx_http_lua_ffi_free_priv_key
+    ngx_lua_ffi_ssl_verify_client = C.ngx_http_lua_ffi_ssl_verify_client
+
+elseif subsystem == 'stream' then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_ssl_set_der_certificate(ngx_stream_lua_request_t *r,
+        const char *data, size_t len, char **err);
+
+    int ngx_stream_lua_ffi_ssl_clear_certs(ngx_stream_lua_request_t *r,
+        char **err);
+
+    int ngx_stream_lua_ffi_ssl_set_der_private_key(ngx_stream_lua_request_t *r,
+        const char *data, size_t len, char **err);
+
+    int ngx_stream_lua_ffi_ssl_raw_server_addr(ngx_stream_lua_request_t *r,
+        char **addr, size_t *addrlen, int *addrtype, char **err);
+
+    int ngx_stream_lua_ffi_ssl_server_port(ngx_stream_lua_request_t *r,
+        unsigned short *server_port, char **err);
+
+    int ngx_stream_lua_ffi_ssl_server_name(ngx_stream_lua_request_t *r,
+        char **name, size_t *namelen, char **err);
+
+    int ngx_stream_lua_ffi_ssl_raw_client_addr(ngx_stream_lua_request_t *r,
+        char **addr, size_t *addrlen, int *addrtype, char **err);
+
+    int ngx_stream_lua_ffi_cert_pem_to_der(const unsigned char *pem,
+        size_t pem_len, unsigned char *der, char **err);
+
+    int ngx_stream_lua_ffi_priv_key_pem_to_der(const unsigned char *pem,
+        size_t pem_len, unsigned char *der, char **err);
+
+    int ngx_stream_lua_ffi_ssl_get_tls1_version(ngx_stream_lua_request_t *r,
+        char **err);
+
+    void *ngx_stream_lua_ffi_parse_pem_cert(const unsigned char *pem,
+        size_t pem_len, char **err);
+
+    void *ngx_stream_lua_ffi_parse_pem_priv_key(const unsigned char *pem,
+        size_t pem_len, char **err);
+
+    int ngx_stream_lua_ffi_set_cert(void *r, void *cdata, char **err);
+
+    int ngx_stream_lua_ffi_set_priv_key(void *r, void *cdata, char **err);
+
+    void ngx_stream_lua_ffi_free_cert(void *cdata);
+
+    void ngx_stream_lua_ffi_free_priv_key(void *cdata);
+
+    int ngx_stream_lua_ffi_ssl_verify_client(void *r,
+        void *cdata, int depth, char **err);
+    ]]
+
+    ngx_lua_ffi_ssl_set_der_certificate =
+        C.ngx_stream_lua_ffi_ssl_set_der_certificate
+    ngx_lua_ffi_ssl_clear_certs = C.ngx_stream_lua_ffi_ssl_clear_certs
+    ngx_lua_ffi_ssl_set_der_private_key =
+        C.ngx_stream_lua_ffi_ssl_set_der_private_key
+    ngx_lua_ffi_ssl_raw_server_addr = C.ngx_stream_lua_ffi_ssl_raw_server_addr
+    ngx_lua_ffi_ssl_server_port = C.ngx_stream_lua_ffi_ssl_server_port
+    ngx_lua_ffi_ssl_server_name = C.ngx_stream_lua_ffi_ssl_server_name
+    ngx_lua_ffi_ssl_raw_client_addr = C.ngx_stream_lua_ffi_ssl_raw_client_addr
+    ngx_lua_ffi_cert_pem_to_der = C.ngx_stream_lua_ffi_cert_pem_to_der
+    ngx_lua_ffi_priv_key_pem_to_der = C.ngx_stream_lua_ffi_priv_key_pem_to_der
+    ngx_lua_ffi_ssl_get_tls1_version = C.ngx_stream_lua_ffi_ssl_get_tls1_version
+    ngx_lua_ffi_parse_pem_cert = C.ngx_stream_lua_ffi_parse_pem_cert
+    ngx_lua_ffi_parse_pem_priv_key = C.ngx_stream_lua_ffi_parse_pem_priv_key
+    ngx_lua_ffi_set_cert = C.ngx_stream_lua_ffi_set_cert
+    ngx_lua_ffi_set_priv_key = C.ngx_stream_lua_ffi_set_priv_key
+    ngx_lua_ffi_free_cert = C.ngx_stream_lua_ffi_free_cert
+    ngx_lua_ffi_free_priv_key = C.ngx_stream_lua_ffi_free_priv_key
+    ngx_lua_ffi_ssl_verify_client = C.ngx_stream_lua_ffi_ssl_verify_client
+end
+
+
+local _M = { version = base.version }
+
+
+local charpp = ffi.new("char*[1]")
+local intp = ffi.new("int[1]")
+local ushortp = ffi.new("unsigned short[1]")
+
+
+function _M.clear_certs()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_ssl_clear_certs(r, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.set_der_cert(data)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_ssl_set_der_certificate(r, data, #data, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.set_der_priv_key(data)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_ssl_set_der_private_key(r, data, #data, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+local addr_types = {
+    [0] = "unix",
+    [1] = "inet",
+    [2] = "inet6",
+}
+
+
+function _M.raw_server_addr()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local sizep = get_size_ptr()
+
+    local rc = ngx_lua_ffi_ssl_raw_server_addr(r, charpp, sizep, intp, errmsg)
+    if rc == FFI_OK then
+        local typ = addr_types[intp[0]]
+        if not typ then
+            return nil, nil, "unknown address type: " .. intp[0]
+        end
+        return ffi_str(charpp[0], sizep[0]), typ
+    end
+
+    return nil, nil, ffi_str(errmsg[0])
+end
+
+
+function _M.server_port()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_ssl_server_port(r, ushortp, errmsg)
+    if rc == FFI_OK then
+        return ushortp[0]
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.server_name()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local sizep = get_size_ptr()
+
+    local rc = ngx_lua_ffi_ssl_server_name(r, charpp, sizep, errmsg)
+    if rc == FFI_OK then
+        return ffi_str(charpp[0], sizep[0])
+    end
+
+    if rc == FFI_DECLINED then
+        return nil
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.raw_client_addr()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local sizep = get_size_ptr()
+
+    local rc = ngx_lua_ffi_ssl_raw_client_addr(r, charpp, sizep, intp, errmsg)
+    if rc == FFI_OK then
+        local typ = addr_types[intp[0]]
+        if not typ then
+            return nil, nil, "unknown address type: " .. intp[0]
+        end
+        return ffi_str(charpp[0], sizep[0]), typ
+    end
+
+    return nil, nil, ffi_str(errmsg[0])
+end
+
+
+function _M.cert_pem_to_der(pem)
+    local outbuf = get_string_buf(#pem)
+
+    local sz = ngx_lua_ffi_cert_pem_to_der(pem, #pem, outbuf, errmsg)
+    if sz > 0 then
+        return ffi_str(outbuf, sz)
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.priv_key_pem_to_der(pem)
+    local outbuf = get_string_buf(#pem)
+
+    local sz = ngx_lua_ffi_priv_key_pem_to_der(pem, #pem, outbuf, errmsg)
+    if sz > 0 then
+        return ffi_str(outbuf, sz)
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+local function get_tls1_version()
+
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local ver = ngx_lua_ffi_ssl_get_tls1_version(r, errmsg)
+
+    ver = tonumber(ver)
+
+    if ver >= 0 then
+        return ver
+    end
+
+    -- rc == FFI_ERROR
+
+    return nil, ffi_str(errmsg[0])
+end
+_M.get_tls1_version = get_tls1_version
+
+
+function _M.parse_pem_cert(pem)
+    local cert = ngx_lua_ffi_parse_pem_cert(pem, #pem, errmsg)
+    if cert ~= nil then
+        return ffi_gc(cert, ngx_lua_ffi_free_cert)
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.parse_pem_priv_key(pem)
+    local pkey = ngx_lua_ffi_parse_pem_priv_key(pem, #pem, errmsg)
+    if pkey ~= nil then
+        return ffi_gc(pkey, ngx_lua_ffi_free_priv_key)
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.set_cert(cert)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_set_cert(r, cert, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.set_priv_key(priv_key)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_set_priv_key(r, priv_key, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+function _M.verify_client(ca_certs, depth)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if not depth then
+        depth = -1
+    end
+
+    local rc = ngx_lua_ffi_ssl_verify_client(r, ca_certs, depth, errmsg)
+    if rc == FFI_OK then
+        return true
+    end
+
+    return nil, ffi_str(errmsg[0])
+end
+
+
+do
+    _M.SSL3_VERSION = 0x0300
+    _M.TLS1_VERSION = 0x0301
+    _M.TLS1_1_VERSION = 0x0302
+    _M.TLS1_2_VERSION = 0x0303
+    _M.TLS1_3_VERSION = 0x0304
+
+    local map = {
+        [_M.SSL3_VERSION] = "SSLv3",
+        [_M.TLS1_VERSION] = "TLSv1",
+        [_M.TLS1_1_VERSION] = "TLSv1.1",
+        [_M.TLS1_2_VERSION] = "TLSv1.2",
+        [_M.TLS1_3_VERSION] = "TLSv1.3",
+    }
+
+    function _M.get_tls1_version_str()
+        local ver, err = get_tls1_version()
+        if not ver then
+            return nil, err
+        end
+
+        local ver_str = map[ver]
+        if not ver_str then
+            return nil, "unknown version"
+        end
+
+        return ver_str
+    end
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/ssl.md

@@ -0,0 +1,583 @@
+Name
+====
+
+ngx.ssl - Lua API for controlling NGINX downstream SSL handshakes
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [clear_certs](#clear_certs)
+    * [cert_pem_to_der](#cert_pem_to_der)
+    * [set_der_cert](#set_der_cert)
+    * [priv_key_pem_to_der](#priv_key_pem_to_der)
+    * [set_der_priv_key](#set_der_priv_key)
+    * [server_name](#server_name)
+    * [server_port](#server_port)
+    * [raw_server_addr](#raw_server_addr)
+    * [raw_client_addr](#raw_client_addr)
+    * [get_tls1_version](#get_tls1_version)
+    * [get_tls1_version_str](#get_tls1_version_str)
+    * [parse_pem_cert](#parse_pem_cert)
+    * [parse_pem_priv_key](#parse_pem_priv_key)
+    * [set_cert](#set_cert)
+    * [set_priv_key](#set_priv_key)
+    * [verify_client](#verify_client)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is production ready.
+
+Synopsis
+========
+
+```nginx
+# Note: you do not need the following line if you are using
+# OpenResty 1.9.7.2+.
+lua_package_path "/path/to/lua-resty-core/lib/?.lua;;";
+
+server {
+    listen 443 ssl;
+    server_name   test.com;
+
+    # useless placeholders: just to shut up NGINX configuration
+    # loader errors:
+    ssl_certificate /path/to/fallback.crt;
+    ssl_certificate_key /path/to/fallback.key;
+
+    ssl_certificate_by_lua_block {
+        local ssl = require "ngx.ssl"
+
+        -- clear the fallback certificates and private keys
+        -- set by the ssl_certificate and ssl_certificate_key
+        -- directives above:
+        local ok, err = ssl.clear_certs()
+        if not ok then
+            ngx.log(ngx.ERR, "failed to clear existing (fallback) certificates")
+            return ngx.exit(ngx.ERROR)
+        end
+
+        -- assuming the user already defines the my_load_certificate_chain()
+        -- herself.
+        local pem_cert_chain = assert(my_load_certificate_chain())
+
+        local der_cert_chain, err = ssl.cert_pem_to_der(pem_cert_chain)
+        if not der_cert_chain then
+            ngx.log(ngx.ERR, "failed to convert certificate chain ",
+                    "from PEM to DER: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        local ok, err = ssl.set_der_cert(der_cert_chain)
+        if not ok then
+            ngx.log(ngx.ERR, "failed to set DER cert: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        -- assuming the user already defines the my_load_private_key()
+        -- function herself.
+        local pem_pkey = assert(my_load_private_key())
+
+        local der_pkey, err = ssl.priv_key_pem_to_der(pem_pkey)
+        if not der_pkey then
+            ngx.log(ngx.ERR, "failed to convert private key ",
+                    "from PEM to DER: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+
+        local ok, err = ssl.set_der_priv_key(der_pkey)
+        if not ok then
+            ngx.log(ngx.ERR, "failed to set DER private key: ", err)
+            return ngx.exit(ngx.ERROR)
+        end
+    }
+
+    location / {
+        root html;
+    }
+}
+```
+
+Description
+===========
+
+This Lua module provides API functions to control the SSL handshake process in contexts like
+[ssl_certificate_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block)
+(of the [ngx_lua](https://github.com/openresty/lua-nginx-module#readme) module).
+
+For web servers serving many (like millions of) https sites, it is often desired to lazily
+load and cache the SSL certificate chain and private key data for the https sites actually
+being served by a particular server. This Lua module provides API to support such use cases
+in the context of the [ssl_certificate_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block)
+directive.
+
+To load the `ngx.ssl` module in Lua, just write
+
+```lua
+local ssl = require "ngx.ssl"
+```
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+clear_certs
+-----------
+**syntax:** *ok, err = ssl.clear_certs()*
+
+**context:** *ssl_certificate_by_lua**
+
+Clears any existing SSL certificates and/or private keys set on the current SSL connection.
+
+Returns `true` on success, or a `nil` value and a string describing the error otherwise.
+
+[Back to TOC](#table-of-contents)
+
+cert_pem_to_der
+---------------
+**syntax:** *der_cert_chain, err = ssl.cert_pem_to_der(pem_cert_chain)*
+
+**context:** *any*
+
+Converts the PEM-formatted SSL certificate chain data into the DER format (for later uses
+in the [set_der_cert](#set_der_cert)
+function, for example).
+
+In case of failures, returns `nil` and a string describing the error.
+
+It is known that the `openssl` command-line utility may not convert the whole SSL
+certificate chain from PEM to DER correctly. So always use this Lua function to do
+the conversion. You can always use libraries like [lua-resty-lrucache](https://github.com/openresty/lua-resty-lrucache#readme)
+and/or ngx_lua APIs like [lua_shared_dict](https://github.com/openresty/lua-nginx-module#lua_shared_dict)
+to do the caching of the DER-formatted results, for example.
+
+This function can be called in any context.
+
+[Back to TOC](#table-of-contents)
+
+set_der_cert
+------------
+**syntax:** *ok, err = ssl.set_der_cert(der_cert_chain)*
+
+**context:** *ssl_certificate_by_lua**
+
+Sets the DER-formatted SSL certificate chain data for the current SSL connection. Note that
+the DER data is
+directly in the Lua string argument. *No* external file names are supported here.
+
+Returns `true` on success, or a `nil` value and a string describing the error otherwise.
+
+Note that, the SSL certificate chain is usually encoded in the PEM format. So you need
+to use the [cert_pem_to_der](#cert_pem_to_der)
+function to do the conversion first.
+
+[Back to TOC](#table-of-contents)
+
+priv_key_pem_to_der
+-------------------
+**syntax:** *der_priv_key, err = ssl.priv_key_pem_to_der(pem_priv_key)*
+
+**context:** *any*
+
+Converts the PEM-formatted SSL private key data into the DER format (for later uses
+in the [set_der_priv_key](#set_der_priv_key)
+function, for example).
+
+In case of failures, returns `nil` and a string describing the error.
+
+Alternatively, you can do the PEM to DER conversion *offline* with the `openssl` command-line utility, like below
+
+```bash
+openssl rsa -in key.pem -outform DER -out key.der
+```
+
+This function can be called in any context.
+
+[Back to TOC](#table-of-contents)
+
+set_der_priv_key
+----------------
+**syntax:** *ok, err = ssl.set_der_priv_key(der_priv_key)*
+
+**context:** *ssl_certificate_by_lua**
+
+Sets the DER-formatted prviate key for the current SSL connection.
+
+Returns `true` on success, or a `nil` value and a string describing the error otherwise.
+
+Usually, the private keys are encoded in the PEM format. You can either use the
+[priv_key_pem_to_der](#priv_key_pem_to_der) function
+to do the PEM to DER conversion or just use
+the `openssl` command-line utility offline, like below
+
+```bash
+openssl rsa -in key.pem -outform DER -out key.der
+```
+
+[Back to TOC](#table-of-contents)
+
+server_name
+-----------
+**syntax:** *name, err = ssl.server_name()*
+
+**context:** *any*
+
+Returns the TLS SNI (Server Name Indication) name set by the client. Returns `nil`
+when the client does not set it.
+
+In case of failures, it returns `nil` *and* a string describing the error.
+
+Usually we use this SNI name as the domain name (like `www.openresty.org`) to
+identify the current web site while loading the corresponding SSL certificate
+chain and private key for the site.
+
+Please note that not all https clients set the SNI name, so when the SNI name is
+missing from the client handshake request, we use the server IP address accessed
+by the client to identify the site. See the [raw_server_addr](#raw_server_addr) method
+for more details.
+
+This function can be called in any context where downstream https is used.
+
+[Back to TOC](#table-of-contents)
+
+server_port
+-----------
+**syntax:** port, err = ssl.server_port()
+
+**context:** *any*
+
+Returns the server port. Returns `nil`
+when server dont have a port.
+
+In case of failures, it returns `nil` *and* a string describing the error.
+
+This function can be called in any context where downstream https is used.
+
+[Back to TOC](#table-of-contents)
+
+raw_server_addr
+---------------
+**syntax:** *addr_data, addr_type, err = ssl.raw_server_addr()*
+
+**context:** *any*
+
+Returns the raw server address actually accessed by the client in the current SSL connection.
+
+The first two return values are strings representing the address data and the address type, respectively.
+The address values are interpreted differently according to the address type values:
+
+* `unix`
+: The address data is a file path for the UNIX domain socket.
+* `inet`
+: The address data is a binary IPv4 address of 4 bytes long.
+* `inet6`
+: The address data is a binary IPv6 address of 16 bytes long.
+
+Returns two `nil` values and a Lua string describing the error.
+
+The following code snippet shows how to print out the UNIX domain socket address and
+the IPv4 address as human-readable strings:
+
+```lua
+local ssl = require "ngx.ssl"
+local byte = string.byte
+
+local addr, addrtyp, err = ssl.raw_server_addr()
+if not addr then
+    ngx.log(ngx.ERR, "failed to fetch raw server addr: ", err)
+    return
+end
+
+if addrtyp == "inet" then  -- IPv4
+    ip = string.format("%d.%d.%d.%d", byte(addr, 1), byte(addr, 2),
+                       byte(addr, 3), byte(addr, 4))
+    print("Using IPv4 address: ", ip)
+
+elseif addrtyp == "unix" then  -- UNIX
+    print("Using unix socket file ", addr)
+
+else  -- IPv6
+    -- leave as an exercise for the readers
+end
+```
+
+This function can be called in any context where downstream https is used.
+
+[Back to TOC](#table-of-contents)
+
+raw_client_addr
+---------------
+**syntax:** *addr_data, addr_type, err = ssl.raw_client_addr()*
+
+**context:** *any*
+
+Returns the raw client address of the current SSL connection.
+
+The first two return values are strings representing the address data and the address type, respectively.
+The address values are interpreted differently according to the address type values:
+
+* `unix`
+: The address data is a file path for the UNIX domain socket.
+* `inet`
+: The address data is a binary IPv4 address of 4 bytes long.
+* `inet6`
+: The address data is a binary IPv6 address of 16 bytes long.
+
+Returns two `nil` values and a Lua string describing the error.
+
+The following code snippet shows how to print out the UNIX domain socket address and
+the IPv4 address as human-readable strings:
+
+```lua
+local ssl = require "ngx.ssl"
+local byte = string.byte
+
+local addr, addrtyp, err = ssl.raw_client_addr()
+if not addr then
+    ngx.log(ngx.ERR, "failed to fetch raw client addr: ", err)
+    return
+end
+
+if addrtyp == "inet" then  -- IPv4
+    ip = string.format("%d.%d.%d.%d", byte(addr, 1), byte(addr, 2),
+                       byte(addr, 3), byte(addr, 4))
+    print("Client IPv4 address: ", ip)
+
+elseif addrtyp == "unix" then  -- UNIX
+    print("Client unix socket file ", addr)
+
+else  -- IPv6
+    -- leave as an exercise for the readers
+end
+```
+
+This function can be called in any context where downstream https is used.
+
+This function was first introduced in lua-resty-core 0.1.14.
+
+[Back to TOC](#table-of-contents)
+
+get_tls1_version
+----------------
+**syntax:** *ver, err = ssl.get_tls1_version()*
+
+**context:** *any*
+
+Returns the TLS 1.x version number used by the current SSL connection. Returns `nil` and
+a string describing the error otherwise.
+
+Typical return values are:
+
+* `0x0300`(SSLv3)
+* `0x0301`(TLSv1)
+* `0x0302`(TLSv1.1)
+* `0x0303`(TLSv1.2)
+* `0x0304`(TLSv1.3)
+
+This function can be called in any context where downstream https is used.
+
+[Back to TOC](#table-of-contents)
+
+get_tls1_version_str
+--------------------
+**syntax:** *ver, err = ssl.get_tls1_version_str()*
+
+**context:** *any*
+
+Returns the TLS 1.x version string used by the current SSL connection. Returns `nil` and
+a string describing the error otherwise.
+
+If the TLS 1.x version number used by the current SSL connection is not
+recognized, the return values will be `nil` and the string "unknown version".
+
+Typical return values are:
+
+* `SSLv3`
+* `TLSv1`
+* `TLSv1.1`
+* `TLSv1.2`
+* `TLSv1.3`
+
+This function can be called in any context where downstream https is used.
+
+[Back to TOC](#table-of-contents)
+
+parse_pem_cert
+--------------
+**syntax:** *cert_chain, err = ssl.parse_pem_cert(pem_cert_chain)*
+
+**context:** *any*
+
+Converts the PEM-formated SSL certificate chain data into an opaque cdata pointer (for later uses
+in the [set_cert](#set_cert)
+function, for example).
+
+In case of failures, returns `nil` and a string describing the error.
+
+You can always use libraries like [lua-resty-lrucache](https://github.com/openresty/lua-resty-lrucache#readme)
+to cache the cdata result.
+
+This function can be called in any context.
+
+This function was first added in version `0.1.7`.
+
+[Back to TOC](#table-of-contents)
+
+parse_pem_priv_key
+------------------
+**syntax:** *priv_key, err = ssl.parse_pem_priv_key(pem_priv_key)*
+
+**context:** *any*
+
+Converts the PEM-formatted SSL private key data into an opaque cdata pointer (for later uses
+in the [set_priv_key](#set_priv_key)
+function, for example).
+
+In case of failures, returns `nil` and a string describing the error.
+
+This function can be called in any context.
+
+This function was first added in version `0.1.7`.
+
+[Back to TOC](#table-of-contents)
+
+set_cert
+--------
+**syntax:** *ok, err = ssl.set_cert(cert_chain)*
+
+**context:** *ssl_certificate_by_lua**
+
+Sets the SSL certificate chain opaque pointer returned by the
+[parse_pem_cert](#parse_pem_cert) function for the current SSL connection.
+
+Returns `true` on success, or a `nil` value and a string describing the error otherwise.
+
+Note that this `set_cert` function will run slightly faster, in terms of CPU cycles wasted, than the
+[set_der_cert](#set_der_cert) variant, since the first function uses opaque cdata pointers
+which do not require any additional conversion needed to be performed by the SSL library during the SSL handshake.
+
+This function was first added in version `0.1.7`.
+
+[Back to TOC](#table-of-contents)
+
+set_priv_key
+------------
+**syntax:** *ok, err = ssl.set_priv_key(priv_key)*
+
+**context:** *ssl_certificate_by_lua**
+
+Sets the SSL private key opaque pointer returned by the
+[parse_pem_priv_key](#parse_pem_priv_key) function for the current SSL connection.
+
+Returns `true` on success, or a `nil` value and a string describing the error otherwise.
+
+Note that this `set_priv_key` function will run slightly faster, in terms of CPU cycles wasted, than the
+[set_der_priv_key](#set_der_priv_key) variant, since the first function uses opaque cdata pointers
+which do not require any additional conversion needed to be performed by the SSL library during the SSL handshake.
+
+This function was first added in version `0.1.7`.
+
+[Back to TOC](#table-of-contents)
+
+verify_client
+-------------
+**syntax:** *ok, err = ssl.verify_client(ca_certs?, depth?)*
+
+**context:** *ssl_certificate_by_lua**
+
+Requires a client certificate during TLS handshake.
+
+The `ca_certs` is the CA certificate chain opaque pointer returned by the
+[parse_pem_cert](#parse_pem_cert) function for the current SSL connection.
+The list of certificates will be sent to clients. Also, they will be added to trusted store.
+If omitted, will not send any CA certificate to clients.
+
+The `depth` is the verification depth in the client certificates chain.
+If omitted, will use the value specified by `ssl_verify_depth`.
+
+Returns `true` on success, or a `nil` value and a string describing the error otherwise.
+
+Note that TLS is not terminated when verification fails. You need to examine Nginx variable `$ssl_client_verify`
+later to determine next steps.
+
+This function was first added in version `0.1.20`.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Yichun Zhang <agentzh@gmail.com> (agentzh), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2015-2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* the [ngx.ocsp](ocsp.md) module.
+* the [ssl_certificate_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_certificate_by_lua_block) directive.
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)

deps/src/lua-resty-core/lib/ngx/ssl/session.lua

@@ -0,0 +1,109 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+base.allows_subsystem('http')
+
+
+local ffi = require "ffi"
+local C = ffi.C
+local ffi_str = ffi.string
+local get_request = base.get_request
+local error = error
+local errmsg = base.get_errmsg_ptr()
+local get_string_buf = base.get_string_buf
+local FFI_ERROR = base.FFI_ERROR
+
+
+ffi.cdef[[
+int ngx_http_lua_ffi_ssl_set_serialized_session(ngx_http_request_t *r,
+    const unsigned char *buf, int len, char **err);
+
+int ngx_http_lua_ffi_ssl_get_serialized_session(ngx_http_request_t *r,
+    char *buf, char **err);
+
+int ngx_http_lua_ffi_ssl_get_session_id(ngx_http_request_t *r,
+    char *buf, char **err);
+
+int ngx_http_lua_ffi_ssl_get_serialized_session_size(ngx_http_request_t *r,
+    char **err);
+
+int ngx_http_lua_ffi_ssl_get_session_id_size(ngx_http_request_t *r,
+    char **err);
+]]
+
+
+local _M = { version = base.version }
+
+
+-- return session, err
+function _M.get_serialized_session()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local len = C.ngx_http_lua_ffi_ssl_get_serialized_session_size(r, errmsg)
+
+    if len < 0 then
+        return nil, ffi_str(errmsg[0])
+    end
+
+    if len > 4096 then
+         return nil, "session too big to serialize"
+    end
+    local buf = get_string_buf(len)
+
+    local rc = C.ngx_http_lua_ffi_ssl_get_serialized_session(r, buf, errmsg)
+
+    if rc == FFI_ERROR then
+         return nil, ffi_str(errmsg[0])
+    end
+
+    return ffi_str(buf, len)
+end
+
+
+-- return session_id, err
+function _M.get_session_id()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local len = C.ngx_http_lua_ffi_ssl_get_session_id_size(r, errmsg)
+
+    if len < 0 then
+        return nil, ffi_str(errmsg[0])
+    end
+
+    local buf = get_string_buf(len)
+
+    local rc = C.ngx_http_lua_ffi_ssl_get_session_id(r, buf, errmsg)
+
+    if rc == FFI_ERROR then
+        return nil, ffi_str(errmsg[0])
+    end
+
+    return ffi_str(buf, len)
+end
+
+
+-- return ok, err
+function _M.set_serialized_session(sess)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local rc = C.ngx_http_lua_ffi_ssl_set_serialized_session(r, sess, #sess,
+                                                             errmsg)
+    if rc == FFI_ERROR then
+        return nil, ffi_str(errmsg[0])
+    end
+
+    return true
+end
+
+
+return _M

deps/src/lua-resty-core/lib/ngx/ssl/session.md

@@ -0,0 +1,277 @@
+Name
+====
+
+ngx.ssl.session - Lua API for manipulating SSL session data and IDs for NGINX downstream SSL connections.
+
+Table of Contents
+=================
+
+* [Name](#name)
+* [Status](#status)
+* [Synopsis](#synopsis)
+* [Description](#description)
+* [Methods](#methods)
+    * [get_session_id](#get_session_id)
+    * [get_serialized_session](#get_serialized_session)
+    * [set_serialized_session](#set_serialized_session)
+* [Community](#community)
+    * [English Mailing List](#english-mailing-list)
+    * [Chinese Mailing List](#chinese-mailing-list)
+* [Bugs and Patches](#bugs-and-patches)
+* [Author](#author)
+* [Copyright and License](#copyright-and-license)
+* [See Also](#see-also)
+
+Status
+======
+
+This Lua module is production ready.
+
+Synopsis
+========
+
+```nginx
+# nginx.conf
+
+# Note: you do not need the following line if you are using
+# OpenResty 1.11.2.1+.
+lua_package_path "/path/to/lua-resty-core/lib/?.lua;;";
+
+ssl_session_fetch_by_lua_block {
+    local ssl_sess = require "ngx.ssl.session"
+
+    local sess_id, err = ssl_sess.get_session_id()
+    if not sess_id then
+        ngx.log(ngx.ERR, "failed to get session ID: ", err)
+        -- considered a cache miss, and just return...
+        return
+    end
+
+    -- the user is supposed to implement the my_lookup_ssl_session_by_id
+    -- Lua function used below. She can look up an external memcached
+    -- or redis cluster, for example. And she can also introduce a local
+    -- cache layer at the same time...
+    local sess, err = my_lookup_ssl_session_by_id(sess_id)
+    if not sess then
+        if err then
+            ngx.log(ngx.ERR, "failed to look up the session by ID ",
+                    sess_id, ": ", err)
+            return
+        end
+
+        -- cache miss...just return
+        return
+    end
+
+    local ok, err = ssl_sess.set_serialized_session(sess)
+    if not ok then
+        ngx.log(ngx.ERR, "failed to set SSL session for ID ", sess_id,
+                ": ", err)
+        -- consider it as a cache miss...
+        return
+    end
+
+    -- done here, SSL session successfully set and should resume accordingly...
+}
+
+ssl_session_store_by_lua_block {
+    local ssl_sess = require "ngx.ssl.session"
+
+    local sess_id, err = ssl_sess.get_session_id()
+    if not sess_id then
+        ngx.log(ngx.ERR, "failed to get session ID: ", err)
+        -- just give up
+        return
+    end
+
+    local sess, err = ssl_sess.get_serialized_session()
+    if not sess then
+        ngx.log(ngx.ERR, "failed to get SSL session from the ",
+                "current connection: ", err)
+        -- just give up
+        return
+    end
+
+    -- for the best performance, we should avoid creating a closure
+    -- dynamically here on the hot code path. Instead, we should
+    -- put this function in one of our own Lua module files. this
+    -- example is just for demonstration purposes...
+    local function save_it(premature, sess_id, sess)
+        -- the user is supposed to implement the
+        -- my_save_ssl_session_by_id Lua function used below.
+        -- She can save to an external memcached
+        -- or redis cluster, for example. And she can also introduce
+        -- a local cache layer at the same time...
+        local sess, err = my_save_ssl_session_by_id(sess_id, sess)
+        if not sess then
+            if err then
+                ngx.log(ngx.ERR, "failed to save the session by ID ",
+                        sess_id, ": ", err)
+                return ngx.exit(ngx.ERROR)
+            end
+
+            -- cache miss...just return
+            return
+        end
+    end
+
+    -- create a 0-delay timer here...
+    local ok, err = ngx.timer.at(0, save_it, sess_id, sess)
+    if not ok then
+        ngx.log(ngx.ERR, "failed to create a 0-delay timer: ", err)
+        return
+    end
+}
+
+server {
+    listen 443 ssl;
+    server_name test.com;
+
+    # well, we could configure ssl_certificate_by_lua* here as well...
+    ssl_certificate /path/to/server-cert.pem;
+    ssl_certificate_key /path/to/server-priv-key.pem;
+}
+```
+
+Description
+===========
+
+This Lua module provides API functions for manipulating SSL session data and IDs for NGINX
+downstream connections. It is mostly for the contexts [ssl_session_fetch_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_session_fetch_by_lua_block)
+and [ssl_session_store_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_session_store_by_lua_block).
+
+This Lua API can be used to implement distributed SSL session caching for downstream SSL connections, thus saving a lot of full SSL handshakes which are very expensive.
+
+To load the `ngx.ssl.session` module in Lua, just write
+
+```lua
+local ssl_sess = require "ngx.ssl.session"
+```
+
+[Back to TOC](#table-of-contents)
+
+Methods
+=======
+
+get_session_id
+--------------
+**syntax:** *id, err = ssl_sess.get_session_id()*
+
+**context:** *ssl_session_fetch_by_lua*, ssl_session_store_by_lua**
+
+Fetches the SSL session ID associated with the current downstream SSL connection.
+The ID is returned as a Lua string.
+
+In case of errors, it returns `nil` and a string describing the error.
+
+This API function is usually called in the contexts of
+[ssl_session_store_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_session_store_by_lua_block)
+and [ssl_session_fetch_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_session_fetch_by_lua_block).
+
+[Back to TOC](#table-of-contents)
+
+get_serialized_session
+----------------------
+**syntax:** *session, err = ssl_sess.get_serialized_session()*
+
+**context:** *ssl_session_store_by_lua**
+
+Returns the serialized form of the SSL session data of the current SSL connection, in a Lua string.
+
+This session can be cached in [lua-resty-lrucache](https://github.com/openresty/lua-resty-lrucache), [lua_shared_dict](https://github.com/openresty/lua-nginx-module#lua_shared_dict),
+and/or external data storage services like `memcached` and `redis`. The SSL session ID returned
+by the [get_session_id](#get_session_id) function is usually used as the cache key.
+
+The returned SSL session data can later be loaded into other SSL connections using the same
+session ID via the [set_serialized_session](#set_serialized_session) function.
+
+In case of errors, it returns `nil` and a string describing the error.
+
+This API function is usually called in the context of
+[ssl_session_store_by_lua*](https://github.com/openresty/lua-nginx-module#ssl_session_store_by_lua_block)
+where the SSL handshake has just completed.
+
+[Back to TOC](#table-of-contents)
+
+set_serialized_session
+----------------------
+**syntax:** *ok, err = ssl_sess.set_serialized_session(session)*
+
+**context:** *ssl_session_fetch_by_lua**
+
+Sets the serialized SSL session provided as the argument to the current SSL connection.
+If the SSL session is successfully set, the current SSL connection can resume the session
+directly without going through the full SSL handshake process (which is very expensive in terms of CPU time).
+
+This API is usually used in the context of [ssl_session_fetch_by_lua*](https://github.com/openresty/lua-nginx-module#ssl_session_fetch_by_lua_block)
+when a cache hit is found with the current SSL session ID.
+
+The serialized SSL session used as the argument should be originally returned by the
+[get_serialized_session](#get_serialized_session) function.
+
+[Back to TOC](#table-of-contents)
+
+Community
+=========
+
+[Back to TOC](#table-of-contents)
+
+English Mailing List
+--------------------
+
+The [openresty-en](https://groups.google.com/group/openresty-en) mailing list is for English speakers.
+
+[Back to TOC](#table-of-contents)
+
+Chinese Mailing List
+--------------------
+
+The [openresty](https://groups.google.com/group/openresty) mailing list is for Chinese speakers.
+
+[Back to TOC](#table-of-contents)
+
+Bugs and Patches
+================
+
+Please report bugs or submit patches by
+
+1. creating a ticket on the [GitHub Issue Tracker](https://github.com/openresty/lua-resty-core/issues),
+1. or posting to the [OpenResty community](#community).
+
+[Back to TOC](#table-of-contents)
+
+Author
+======
+
+Yichun Zhang <agentzh@gmail.com> (agentzh), OpenResty Inc.
+
+[Back to TOC](#table-of-contents)
+
+Copyright and License
+=====================
+
+This module is licensed under the BSD license.
+
+Copyright (C) 2016-2017, by Yichun "agentzh" Zhang, OpenResty Inc.
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
+
+* Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
+
+* Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+[Back to TOC](#table-of-contents)
+
+See Also
+========
+* the ngx_lua module: https://github.com/openresty/lua-nginx-module
+* the [ssl_session_fetch_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_session_fetch_by_lua_block) directive.
+* the [ssl_session_store_by_lua*](https://github.com/openresty/lua-nginx-module/#ssl_session_store_by_lua_block) directive.
+* the [lua-resty-core](https://github.com/openresty/lua-resty-core) library.
+* OpenResty: https://openresty.org
+
+[Back to TOC](#table-of-contents)

deps/src/lua-resty-core/lib/resty/core.lua

@@ -0,0 +1,35 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+local subsystem = ngx.config.subsystem
+
+
+require "resty.core.var"
+require "resty.core.worker"
+require "resty.core.regex"
+require "resty.core.shdict"
+require "resty.core.time"
+require "resty.core.hash"
+require "resty.core.uri"
+require "resty.core.exit"
+require "resty.core.base64"
+require "resty.core.request"
+
+
+if subsystem == 'http' then
+    require "resty.core.response"
+    require "resty.core.phase"
+    require "resty.core.ndk"
+    require "resty.core.socket"
+end
+
+
+require "resty.core.misc"
+require "resty.core.ctx"
+
+
+local base = require "resty.core.base"
+
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/base.lua

@@ -0,0 +1,259 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require 'ffi'
+local ffi_new = ffi.new
+local error = error
+local select = select
+local ceil = math.ceil
+local subsystem = ngx.config.subsystem
+
+
+local str_buf_size = 4096
+local str_buf
+local size_ptr
+local FREE_LIST_REF = 0
+
+
+if subsystem == 'http' then
+    local ngx_lua_v = ngx.config.ngx_lua_version
+    if not ngx.config
+       or not ngx.config.ngx_lua_version
+       or (ngx_lua_v ~= 10019 and ngx_lua_v ~= 10020)
+    then
+        error("ngx_http_lua_module 0.10.19 or 0.10.20 required")
+    end
+
+elseif subsystem == 'stream' then
+    if not ngx.config
+       or not ngx.config.ngx_lua_version
+       or ngx.config.ngx_lua_version ~= 10
+    then
+        error("ngx_stream_lua_module 0.0.10 required")
+    end
+
+else
+    error("ngx_http_lua_module 0.10.20 or "
+          .. "ngx_stream_lua_module 0.0.10 required")
+end
+
+
+if string.find(jit.version, " 2.0", 1, true) then
+    ngx.log(ngx.ALERT, "use of lua-resty-core with LuaJIT 2.0 is ",
+            "not recommended; use LuaJIT 2.1+ instead")
+end
+
+
+local ok, new_tab = pcall(require, "table.new")
+if not ok then
+    new_tab = function (narr, nrec) return {} end
+end
+
+
+local clear_tab
+ok, clear_tab = pcall(require, "table.clear")
+if not ok then
+    local pairs = pairs
+    clear_tab = function (tab)
+                    for k, _ in pairs(tab) do
+                        tab[k] = nil
+                    end
+                end
+end
+
+
+-- XXX for now LuaJIT 2.1 cannot compile require()
+-- so we make the fast code path Lua only in our own
+-- wrapper so that most of the require() calls in hot
+-- Lua code paths can be JIT compiled.
+do
+    local orig_require = require
+    local pkg_loaded = package.loaded
+    local function my_require(name)
+        local mod = pkg_loaded[name]
+        if mod then
+            return mod
+        end
+        return orig_require(name)
+    end
+    getfenv(0).require = my_require
+end
+
+
+if not pcall(ffi.typeof, "ngx_str_t") then
+    ffi.cdef[[
+        typedef struct {
+            size_t                 len;
+            const unsigned char   *data;
+        } ngx_str_t;
+    ]]
+end
+
+
+if subsystem == 'http' then
+    if not pcall(ffi.typeof, "ngx_http_request_t") then
+        ffi.cdef[[
+            typedef struct ngx_http_request_s  ngx_http_request_t;
+        ]]
+    end
+
+    if not pcall(ffi.typeof, "ngx_http_lua_ffi_str_t") then
+        ffi.cdef[[
+            typedef struct {
+                int                       len;
+                const unsigned char      *data;
+            } ngx_http_lua_ffi_str_t;
+        ]]
+    end
+
+elseif subsystem == 'stream' then
+    if not pcall(ffi.typeof, "ngx_stream_lua_request_t") then
+        ffi.cdef[[
+            typedef struct ngx_stream_lua_request_s  ngx_stream_lua_request_t;
+        ]]
+    end
+
+    if not pcall(ffi.typeof, "ngx_stream_lua_ffi_str_t") then
+        ffi.cdef[[
+            typedef struct {
+                int                       len;
+                const unsigned char      *data;
+            } ngx_stream_lua_ffi_str_t;
+        ]]
+    end
+
+else
+    error("unknown subsystem: " .. subsystem)
+end
+
+
+local c_buf_type = ffi.typeof("char[?]")
+
+
+local _M = new_tab(0, 18)
+
+
+_M.version = "0.1.22"
+_M.new_tab = new_tab
+_M.clear_tab = clear_tab
+
+
+local errmsg
+
+
+function _M.get_errmsg_ptr()
+    if not errmsg then
+        errmsg = ffi_new("char *[1]")
+    end
+    return errmsg
+end
+
+
+if not ngx then
+    error("no existing ngx. table found")
+end
+
+
+function _M.set_string_buf_size(size)
+    if size <= 0 then
+        return
+    end
+    if str_buf then
+        str_buf = nil
+    end
+    str_buf_size = ceil(size)
+end
+
+
+function _M.get_string_buf_size()
+    return str_buf_size
+end
+
+
+function _M.get_size_ptr()
+    if not size_ptr then
+        size_ptr = ffi_new("size_t[1]")
+    end
+
+    return size_ptr
+end
+
+
+function _M.get_string_buf(size, must_alloc)
+    -- ngx.log(ngx.ERR, "str buf size: ", str_buf_size)
+    if size > str_buf_size or must_alloc then
+        return ffi_new(c_buf_type, size)
+    end
+
+    if not str_buf then
+        str_buf = ffi_new(c_buf_type, str_buf_size)
+    end
+
+    return str_buf
+end
+
+
+function _M.ref_in_table(tb, key)
+    if key == nil then
+        return -1
+    end
+    local ref = tb[FREE_LIST_REF]
+    if ref and ref ~= 0 then
+         tb[FREE_LIST_REF] = tb[ref]
+
+    else
+        ref = #tb + 1
+    end
+    tb[ref] = key
+
+    -- print("ref key_id returned ", ref)
+    return ref
+end
+
+
+function _M.allows_subsystem(...)
+    local total = select("#", ...)
+
+    for i = 1, total do
+        if select(i, ...) == subsystem then
+            return
+        end
+    end
+
+    error("unsupported subsystem: " .. subsystem, 2)
+end
+
+
+_M.FFI_OK = 0
+_M.FFI_NO_REQ_CTX = -100
+_M.FFI_BAD_CONTEXT = -101
+_M.FFI_ERROR = -1
+_M.FFI_AGAIN = -2
+_M.FFI_BUSY = -3
+_M.FFI_DONE = -4
+_M.FFI_DECLINED = -5
+
+
+do
+    local exdata
+
+    ok, exdata = pcall(require, "thread.exdata")
+    if ok and exdata then
+        function _M.get_request()
+            local r = exdata()
+            if r ~= nil then
+                return r
+            end
+        end
+
+    else
+        local getfenv = getfenv
+
+        function _M.get_request()
+            return getfenv(0).__ngx_req
+        end
+    end
+end
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/base64.lua

@@ -0,0 +1,115 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_string = ffi.string
+local ngx = ngx
+local type = type
+local error = error
+local floor = math.floor
+local tostring = tostring
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_encode_base64
+local ngx_lua_ffi_decode_base64
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    size_t ngx_http_lua_ffi_encode_base64(const unsigned char *src,
+                                          size_t len, unsigned char *dst,
+                                          int no_padding);
+
+    int ngx_http_lua_ffi_decode_base64(const unsigned char *src,
+                                       size_t len, unsigned char *dst,
+                                       size_t *dlen);
+    ]]
+
+    ngx_lua_ffi_encode_base64 = C.ngx_http_lua_ffi_encode_base64
+    ngx_lua_ffi_decode_base64 = C.ngx_http_lua_ffi_decode_base64
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    size_t ngx_stream_lua_ffi_encode_base64(const unsigned char *src,
+                                            size_t len, unsigned char *dst,
+                                            int no_padding);
+
+    int ngx_stream_lua_ffi_decode_base64(const unsigned char *src,
+                                         size_t len, unsigned char *dst,
+                                         size_t *dlen);
+    ]]
+
+    ngx_lua_ffi_encode_base64 = C.ngx_stream_lua_ffi_encode_base64
+    ngx_lua_ffi_decode_base64 = C.ngx_stream_lua_ffi_decode_base64
+end
+
+
+local function base64_encoded_length(len, no_padding)
+    return no_padding and floor((len * 8 + 5) / 6) or
+           floor((len + 2) / 3) * 4
+end
+
+
+ngx.encode_base64 = function (s, no_padding)
+    if type(s) ~= 'string' then
+        if not s then
+            s = ''
+        else
+            s = tostring(s)
+        end
+    end
+
+    local slen = #s
+    local no_padding_bool = false;
+    local no_padding_int = 0;
+
+    if no_padding then
+        if no_padding ~= true then
+            local typ = type(no_padding)
+            error("bad no_padding: boolean expected, got " .. typ, 2)
+        end
+
+        no_padding_bool = true
+        no_padding_int  = 1;
+    end
+
+    local dlen = base64_encoded_length(slen, no_padding_bool)
+    local dst = get_string_buf(dlen)
+    local r_dlen = ngx_lua_ffi_encode_base64(s, slen, dst, no_padding_int)
+    -- if dlen ~= r_dlen then error("discrepancy in len") end
+    return ffi_string(dst, r_dlen)
+end
+
+
+local function base64_decoded_length(len)
+    return floor((len + 3) / 4) * 3
+end
+
+
+ngx.decode_base64 = function (s)
+    if type(s) ~= 'string' then
+        error("string argument only", 2)
+    end
+    local slen = #s
+    local dlen = base64_decoded_length(slen)
+    -- print("dlen: ", tonumber(dlen))
+    local dst = get_string_buf(dlen)
+    local pdlen = get_size_ptr()
+    local ok = ngx_lua_ffi_decode_base64(s, slen, dst, pdlen)
+    if ok == 0 then
+        return nil
+    end
+    return ffi_string(dst, pdlen[0])
+end
+
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/ctx.lua

@@ -0,0 +1,143 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local debug = require "debug"
+local base = require "resty.core.base"
+local misc = require "resty.core.misc"
+
+
+local C = ffi.C
+local register_getter = misc.register_ngx_magic_key_getter
+local register_setter = misc.register_ngx_magic_key_setter
+local registry = debug.getregistry()
+local new_tab = base.new_tab
+local ref_in_table = base.ref_in_table
+local get_request = base.get_request
+local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX
+local FFI_OK = base.FFI_OK
+local error = error
+local setmetatable = setmetatable
+local type = type
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_get_ctx_ref
+local ngx_lua_ffi_set_ctx_ref
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_get_ctx_ref(ngx_http_request_t *r, int *in_ssl_phase,
+        int *ssl_ctx_ref);
+    int ngx_http_lua_ffi_set_ctx_ref(ngx_http_request_t *r, int ref);
+    ]]
+
+    ngx_lua_ffi_get_ctx_ref = C.ngx_http_lua_ffi_get_ctx_ref
+    ngx_lua_ffi_set_ctx_ref = C.ngx_http_lua_ffi_set_ctx_ref
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_get_ctx_ref(ngx_stream_lua_request_t *r,
+        int *in_ssl_phase, int *ssl_ctx_ref);
+    int ngx_stream_lua_ffi_set_ctx_ref(ngx_stream_lua_request_t *r, int ref);
+    ]]
+
+    ngx_lua_ffi_get_ctx_ref = C.ngx_stream_lua_ffi_get_ctx_ref
+    ngx_lua_ffi_set_ctx_ref = C.ngx_stream_lua_ffi_set_ctx_ref
+end
+
+
+local _M = {
+    _VERSION = base.version
+}
+
+
+local get_ctx_table
+do
+    local in_ssl_phase = ffi.new("int[1]")
+    local ssl_ctx_ref = ffi.new("int[1]")
+
+    function get_ctx_table(ctx)
+        local r = get_request()
+
+        if not r then
+            error("no request found")
+        end
+
+        local ctx_ref = ngx_lua_ffi_get_ctx_ref(r, in_ssl_phase, ssl_ctx_ref)
+        if ctx_ref == FFI_NO_REQ_CTX then
+            error("no request ctx found")
+        end
+
+        local ctxs = registry.ngx_lua_ctx_tables
+        if ctx_ref < 0 then
+            ctx_ref = ssl_ctx_ref[0]
+            if ctx_ref > 0 and ctxs[ctx_ref] then
+                if in_ssl_phase[0] ~= 0 then
+                    return ctxs[ctx_ref]
+                end
+
+                if not ctx then
+                    ctx = new_tab(0, 4)
+                end
+
+                ctx = setmetatable(ctx, ctxs[ctx_ref])
+
+            else
+                if in_ssl_phase[0] ~= 0 then
+                    if not ctx then
+                        ctx = new_tab(1, 4)
+                    end
+
+                    -- to avoid creating another table, we assume the users
+                    -- won't overwrite the `__index` key
+                    ctx.__index = ctx
+
+                elseif not ctx then
+                    ctx = new_tab(0, 4)
+                end
+            end
+
+            ctx_ref = ref_in_table(ctxs, ctx)
+            if ngx_lua_ffi_set_ctx_ref(r, ctx_ref) ~= FFI_OK then
+                return nil
+            end
+            return ctx
+        end
+        return ctxs[ctx_ref]
+    end
+end
+register_getter("ctx", get_ctx_table)
+_M.get_ctx_table = get_ctx_table
+
+
+local function set_ctx_table(ctx)
+    local ctx_type = type(ctx)
+    if ctx_type ~= "table" then
+        error("ctx should be a table while getting a " .. ctx_type)
+    end
+
+    local r = get_request()
+
+    if not r then
+        error("no request found")
+    end
+
+    local ctx_ref = ngx_lua_ffi_get_ctx_ref(r, nil, nil)
+    if ctx_ref == FFI_NO_REQ_CTX then
+        error("no request ctx found")
+    end
+
+    local ctxs = registry.ngx_lua_ctx_tables
+    if ctx_ref < 0 then
+        ctx_ref = ref_in_table(ctxs, ctx)
+        ngx_lua_ffi_set_ctx_ref(r, ctx_ref)
+        return
+    end
+    ctxs[ctx_ref] = ctx
+end
+register_setter("ctx", set_ctx_table)
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/exit.lua

@@ -0,0 +1,66 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_string = ffi.string
+local ngx = ngx
+local error = error
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local get_request = base.get_request
+local co_yield = coroutine._yield
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_exit
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_exit(ngx_http_request_t *r, int status,
+                               unsigned char *err, size_t *errlen);
+    ]]
+
+    ngx_lua_ffi_exit = C.ngx_http_lua_ffi_exit
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_exit(ngx_stream_lua_request_t *r, int status,
+                                unsigned char *err, size_t *errlen);
+    ]]
+
+    ngx_lua_ffi_exit = C.ngx_stream_lua_ffi_exit
+end
+
+
+local ERR_BUF_SIZE = 128
+local FFI_DONE = base.FFI_DONE
+
+
+ngx.exit = function (rc)
+    local err = get_string_buf(ERR_BUF_SIZE)
+    local errlen = get_size_ptr()
+    local r = get_request()
+    if r == nil then
+        error("no request found")
+    end
+    errlen[0] = ERR_BUF_SIZE
+    rc = ngx_lua_ffi_exit(r, rc, err, errlen)
+    if rc == 0 then
+        -- print("yielding...")
+        return co_yield()
+    end
+    if rc == FFI_DONE then
+        return
+    end
+    error(ffi_string(err, errlen[0]), 2)
+end
+
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/hash.lua

@@ -0,0 +1,154 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_new = ffi.new
+local ffi_string = ffi.string
+local ngx = ngx
+local type = type
+local error = error
+local tostring = tostring
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_md5
+local ngx_lua_ffi_md5_bin
+local ngx_lua_ffi_sha1_bin
+local ngx_lua_ffi_crc32_long
+local ngx_lua_ffi_crc32_short
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    void ngx_http_lua_ffi_md5_bin(const unsigned char *src, size_t len,
+                                  unsigned char *dst);
+
+    void ngx_http_lua_ffi_md5(const unsigned char *src, size_t len,
+                              unsigned char *dst);
+
+    int ngx_http_lua_ffi_sha1_bin(const unsigned char *src, size_t len,
+                                  unsigned char *dst);
+
+    unsigned int ngx_http_lua_ffi_crc32_long(const unsigned char *src,
+                                             size_t len);
+
+    unsigned int ngx_http_lua_ffi_crc32_short(const unsigned char *src,
+                                              size_t len);
+    ]]
+
+    ngx_lua_ffi_md5 = C.ngx_http_lua_ffi_md5
+    ngx_lua_ffi_md5_bin = C.ngx_http_lua_ffi_md5_bin
+    ngx_lua_ffi_sha1_bin = C.ngx_http_lua_ffi_sha1_bin
+    ngx_lua_ffi_crc32_short = C.ngx_http_lua_ffi_crc32_short
+    ngx_lua_ffi_crc32_long = C.ngx_http_lua_ffi_crc32_long
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    void ngx_stream_lua_ffi_md5_bin(const unsigned char *src, size_t len,
+                                    unsigned char *dst);
+
+    void ngx_stream_lua_ffi_md5(const unsigned char *src, size_t len,
+                                unsigned char *dst);
+
+    int ngx_stream_lua_ffi_sha1_bin(const unsigned char *src, size_t len,
+                                    unsigned char *dst);
+
+    unsigned int ngx_stream_lua_ffi_crc32_long(const unsigned char *src,
+                                               size_t len);
+
+    unsigned int ngx_stream_lua_ffi_crc32_short(const unsigned char *src,
+                                                size_t len);
+    ]]
+
+    ngx_lua_ffi_md5 = C.ngx_stream_lua_ffi_md5
+    ngx_lua_ffi_md5_bin = C.ngx_stream_lua_ffi_md5_bin
+    ngx_lua_ffi_sha1_bin = C.ngx_stream_lua_ffi_sha1_bin
+    ngx_lua_ffi_crc32_short = C.ngx_stream_lua_ffi_crc32_short
+    ngx_lua_ffi_crc32_long = C.ngx_stream_lua_ffi_crc32_long
+end
+
+
+local MD5_DIGEST_LEN = 16
+local md5_buf = ffi_new("unsigned char[?]", MD5_DIGEST_LEN)
+
+ngx.md5_bin = function (s)
+    if type(s) ~= 'string' then
+        if not s then
+            s = ''
+        else
+            s = tostring(s)
+        end
+    end
+    ngx_lua_ffi_md5_bin(s, #s, md5_buf)
+    return ffi_string(md5_buf, MD5_DIGEST_LEN)
+end
+
+
+local MD5_HEX_DIGEST_LEN = MD5_DIGEST_LEN * 2
+local md5_hex_buf = ffi_new("unsigned char[?]", MD5_HEX_DIGEST_LEN)
+
+ngx.md5 = function (s)
+    if type(s) ~= 'string' then
+        if not s then
+            s = ''
+        else
+            s = tostring(s)
+        end
+    end
+    ngx_lua_ffi_md5(s, #s, md5_hex_buf)
+    return ffi_string(md5_hex_buf, MD5_HEX_DIGEST_LEN)
+end
+
+
+local SHA_DIGEST_LEN = 20
+local sha_buf = ffi_new("unsigned char[?]", SHA_DIGEST_LEN)
+
+ngx.sha1_bin = function (s)
+    if type(s) ~= 'string' then
+        if not s then
+            s = ''
+        else
+            s = tostring(s)
+        end
+    end
+    local ok = ngx_lua_ffi_sha1_bin(s, #s, sha_buf)
+    if ok == 0 then
+        error("SHA-1 support missing in Nginx")
+    end
+    return ffi_string(sha_buf, SHA_DIGEST_LEN)
+end
+
+
+ngx.crc32_short = function (s)
+    if type(s) ~= "string" then
+        if not s then
+            s = ""
+        else
+            s = tostring(s)
+        end
+    end
+
+    return ngx_lua_ffi_crc32_short(s, #s)
+end
+
+
+ngx.crc32_long = function (s)
+    if type(s) ~= "string" then
+        if not s then
+            s = ""
+        else
+            s = tostring(s)
+        end
+    end
+
+    return ngx_lua_ffi_crc32_long(s, #s)
+end
+
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/misc.lua

@@ -0,0 +1,240 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local base = require "resty.core.base"
+local ffi = require "ffi"
+local os = require "os"
+
+
+local C = ffi.C
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local ngx = ngx
+local type = type
+local error = error
+local rawget = rawget
+local rawset = rawset
+local tonumber = tonumber
+local setmetatable = setmetatable
+local FFI_OK = base.FFI_OK
+local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX
+local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT
+local new_tab = base.new_tab
+local get_request = base.get_request
+local get_size_ptr = base.get_size_ptr
+local get_string_buf = base.get_string_buf
+local get_string_buf_size = base.get_string_buf_size
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_get_resp_status
+local ngx_lua_ffi_get_conf_env
+local ngx_magic_key_getters
+local ngx_magic_key_setters
+
+
+local _M = new_tab(0, 3)
+local ngx_mt = new_tab(0, 2)
+
+
+if subsystem == "http" then
+    ngx_magic_key_getters = new_tab(0, 4)
+    ngx_magic_key_setters = new_tab(0, 2)
+
+elseif subsystem == "stream" then
+    ngx_magic_key_getters = new_tab(0, 2)
+    ngx_magic_key_setters = new_tab(0, 1)
+end
+
+
+local function register_getter(key, func)
+    ngx_magic_key_getters[key] = func
+end
+_M.register_ngx_magic_key_getter = register_getter
+
+
+local function register_setter(key, func)
+    ngx_magic_key_setters[key] = func
+end
+_M.register_ngx_magic_key_setter = register_setter
+
+
+ngx_mt.__index = function (tb, key)
+    local f = ngx_magic_key_getters[key]
+    if f then
+        return f()
+    end
+    return rawget(tb, key)
+end
+
+
+ngx_mt.__newindex = function (tb, key, ctx)
+    local f = ngx_magic_key_setters[key]
+    if f then
+        return f(ctx)
+    end
+    return rawset(tb, key, ctx)
+end
+
+
+setmetatable(ngx, ngx_mt)
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_get_resp_status(ngx_http_request_t *r);
+    int ngx_http_lua_ffi_set_resp_status(ngx_http_request_t *r, int r);
+    int ngx_http_lua_ffi_is_subrequest(ngx_http_request_t *r);
+    int ngx_http_lua_ffi_headers_sent(ngx_http_request_t *r);
+    int ngx_http_lua_ffi_get_conf_env(const unsigned char *name,
+                                      unsigned char **env_buf,
+                                      size_t *name_len);
+    ]]
+
+
+    ngx_lua_ffi_get_resp_status = C.ngx_http_lua_ffi_get_resp_status
+    ngx_lua_ffi_get_conf_env = C.ngx_http_lua_ffi_get_conf_env
+
+
+    -- ngx.status
+
+
+    local function set_status(status)
+        local r = get_request()
+
+        if not r then
+            error("no request found")
+        end
+
+        if type(status) ~= 'number' then
+            status = tonumber(status)
+        end
+
+        local rc = C.ngx_http_lua_ffi_set_resp_status(r, status)
+
+        if rc == FFI_BAD_CONTEXT then
+            error("API disabled in the current context", 2)
+        end
+
+        return
+    end
+    register_setter("status", set_status)
+
+
+    -- ngx.is_subrequest
+
+
+    local function is_subreq()
+        local r = get_request()
+
+        if not r then
+            error("no request found")
+        end
+
+        local rc = C.ngx_http_lua_ffi_is_subrequest(r)
+
+        if rc == FFI_BAD_CONTEXT then
+            error("API disabled in the current context", 2)
+        end
+
+        return rc == 1
+    end
+    register_getter("is_subrequest", is_subreq)
+
+
+    -- ngx.headers_sent
+
+
+    local function headers_sent()
+        local r = get_request()
+
+        if not r then
+            error("no request found")
+        end
+
+        local rc = C.ngx_http_lua_ffi_headers_sent(r)
+
+        if rc == FFI_NO_REQ_CTX then
+            error("no request ctx found")
+        end
+
+        if rc == FFI_BAD_CONTEXT then
+            error("API disabled in the current context", 2)
+        end
+
+        return rc == 1
+    end
+    register_getter("headers_sent", headers_sent)
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_get_resp_status(ngx_stream_lua_request_t *r);
+    int ngx_stream_lua_ffi_get_conf_env(const unsigned char *name,
+                                        unsigned char **env_buf,
+                                        size_t *name_len);
+    ]]
+
+    ngx_lua_ffi_get_resp_status = C.ngx_stream_lua_ffi_get_resp_status
+    ngx_lua_ffi_get_conf_env = C.ngx_stream_lua_ffi_get_conf_env
+end
+
+
+-- ngx.status
+
+
+local function get_status()
+    local r = get_request()
+
+    if not r then
+        error("no request found")
+    end
+
+    local rc = ngx_lua_ffi_get_resp_status(r)
+
+    if rc == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    return rc
+end
+register_getter("status", get_status)
+
+
+do
+    local _getenv = os.getenv
+    local env_ptr = ffi_new("unsigned char *[1]")
+
+    os.getenv = function (name)
+        local r = get_request()
+        if r then
+            -- past init_by_lua* phase now
+            os.getenv = _getenv
+            env_ptr = nil
+            return os.getenv(name)
+        end
+
+        local size = get_string_buf_size()
+        env_ptr[0] = get_string_buf(size)
+        local name_len_ptr = get_size_ptr()
+
+        local rc = ngx_lua_ffi_get_conf_env(name, env_ptr, name_len_ptr)
+        if rc == FFI_OK then
+            return ffi_str(env_ptr[0] + name_len_ptr[0] + 1)
+        end
+
+        -- FFI_DECLINED
+
+        local value = _getenv(name)
+        if value ~= nil then
+            return value
+        end
+
+        return nil
+    end
+end
+
+
+_M._VERSION = base.version
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/ndk.lua

@@ -0,0 +1,92 @@
+-- Copyright (C) by OpenResty Inc.
+
+
+local ffi = require 'ffi'
+local base = require "resty.core.base"
+base.allows_subsystem('http')
+
+
+local C = ffi.C
+local ffi_cast = ffi.cast
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local FFI_OK = base.FFI_OK
+local new_tab = base.new_tab
+local get_string_buf = base.get_string_buf
+local get_request = base.get_request
+local setmetatable = setmetatable
+local type = type
+local tostring = tostring
+local error = error
+
+
+local _M = {
+    version = base.version
+}
+
+
+ffi.cdef[[
+typedef void * ndk_set_var_value_pt;
+
+int ngx_http_lua_ffi_ndk_lookup_directive(const unsigned char *var_data,
+    size_t var_len, ndk_set_var_value_pt *func);
+int ngx_http_lua_ffi_ndk_set_var_get(ngx_http_request_t *r,
+    ndk_set_var_value_pt func, const unsigned char *arg_data, size_t arg_len,
+    ngx_http_lua_ffi_str_t *value);
+]]
+
+
+local func_p = ffi_new("void*[1]")
+local ffi_str_size = ffi.sizeof("ngx_http_lua_ffi_str_t")
+local ffi_str_type = ffi.typeof("ngx_http_lua_ffi_str_t*")
+
+
+local function ndk_set_var_get(self, var)
+    if type(var) ~= "string" then
+        var = tostring(var)
+    end
+
+    if C.ngx_http_lua_ffi_ndk_lookup_directive(var, #var, func_p) ~= FFI_OK then
+        error('ndk.set_var: directive "' .. var
+              .. '" not found or does not use ndk_set_var_value', 2)
+    end
+
+    local func = func_p[0]
+
+    return function (arg)
+        local r = get_request()
+        if not r then
+            error("no request found")
+        end
+
+        if type(arg) ~= "string" then
+            arg = tostring(arg)
+        end
+
+        local buf = get_string_buf(ffi_str_size)
+        local value = ffi_cast(ffi_str_type, buf)
+        local rc = C.ngx_http_lua_ffi_ndk_set_var_get(r, func, arg, #arg, value)
+        if rc ~= FFI_OK then
+            error("calling directive " .. var .. " failed with code " .. rc, 2)
+        end
+
+        return ffi_str(value.data, value.len)
+    end
+end
+
+
+local function ndk_set_var_set()
+    error("not allowed", 2)
+end
+
+
+if ndk then
+    local mt = new_tab(0, 2)
+    mt.__newindex = ndk_set_var_set
+    mt.__index = ndk_set_var_get
+
+    ndk.set_var = setmetatable(new_tab(0, 0), mt)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/phase.lua

@@ -0,0 +1,59 @@
+local ffi = require 'ffi'
+local base = require "resty.core.base"
+
+local C = ffi.C
+local FFI_ERROR = base.FFI_ERROR
+local get_request = base.get_request
+local error = error
+local tostring = tostring
+
+
+ffi.cdef[[
+int ngx_http_lua_ffi_get_phase(ngx_http_request_t *r, char **err)
+]]
+
+
+local errmsg = base.get_errmsg_ptr()
+local context_names = {
+    [0x0001] = "set",
+    [0x0002] = "rewrite",
+    [0x0004] = "access",
+    [0x0008] = "content",
+    [0x0010] = "log",
+    [0x0020] = "header_filter",
+    [0x0040] = "body_filter",
+    [0x0080] = "timer",
+    [0x0100] = "init_worker",
+    [0x0200] = "balancer",
+    [0x0400] = "ssl_cert",
+    [0x0800] = "ssl_session_store",
+    [0x1000] = "ssl_session_fetch",
+    [0x2000] = "exit_worker",
+}
+
+
+function ngx.get_phase()
+    local r = get_request()
+
+    -- if we have no request object, assume we are called from the "init" phase
+    if not r then
+        return "init"
+    end
+
+    local context = C.ngx_http_lua_ffi_get_phase(r, errmsg)
+    if context == FFI_ERROR then -- NGX_ERROR
+        error(errmsg, 2)
+    end
+
+    local phase = context_names[context]
+    if not phase then
+        error("unknown phase: " .. tostring(context))
+    end
+
+    return phase
+end
+
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/request.lua

@@ -0,0 +1,451 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require 'ffi'
+local base = require "resty.core.base"
+local utils = require "resty.core.utils"
+
+
+local subsystem = ngx.config.subsystem
+local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT
+local FFI_DECLINED = base.FFI_DECLINED
+local FFI_OK = base.FFI_OK
+local new_tab = base.new_tab
+local C = ffi.C
+local ffi_cast = ffi.cast
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local setmetatable = setmetatable
+local lower = string.lower
+local rawget = rawget
+local ngx = ngx
+local get_request = base.get_request
+local type = type
+local error = error
+local tostring = tostring
+local tonumber = tonumber
+local str_replace_char = utils.str_replace_char
+
+
+local _M = {
+    version = base.version
+}
+
+
+local ngx_lua_ffi_req_start_time
+
+
+if subsystem == "stream" then
+    ffi.cdef[[
+    double ngx_stream_lua_ffi_req_start_time(ngx_stream_lua_request_t *r);
+    ]]
+
+    ngx_lua_ffi_req_start_time = C.ngx_stream_lua_ffi_req_start_time
+
+elseif subsystem == "http" then
+    ffi.cdef[[
+    double ngx_http_lua_ffi_req_start_time(ngx_http_request_t *r);
+    ]]
+
+    ngx_lua_ffi_req_start_time = C.ngx_http_lua_ffi_req_start_time
+end
+
+
+function ngx.req.start_time()
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    return tonumber(ngx_lua_ffi_req_start_time(r))
+end
+
+
+if subsystem == "stream" then
+    return _M
+end
+
+
+local errmsg = base.get_errmsg_ptr()
+local ffi_str_type = ffi.typeof("ngx_http_lua_ffi_str_t*")
+local ffi_str_size = ffi.sizeof("ngx_http_lua_ffi_str_t")
+
+
+ffi.cdef[[
+    typedef struct {
+        ngx_http_lua_ffi_str_t   key;
+        ngx_http_lua_ffi_str_t   value;
+    } ngx_http_lua_ffi_table_elt_t;
+
+    int ngx_http_lua_ffi_req_get_headers_count(ngx_http_request_t *r,
+        int max, int *truncated);
+
+    int ngx_http_lua_ffi_req_get_headers(ngx_http_request_t *r,
+        ngx_http_lua_ffi_table_elt_t *out, int count, int raw);
+
+    int ngx_http_lua_ffi_req_get_uri_args_count(ngx_http_request_t *r,
+        int max, int *truncated);
+
+    size_t ngx_http_lua_ffi_req_get_querystring_len(ngx_http_request_t *r);
+
+    int ngx_http_lua_ffi_req_get_uri_args(ngx_http_request_t *r,
+        unsigned char *buf, ngx_http_lua_ffi_table_elt_t *out, int count);
+
+    int ngx_http_lua_ffi_req_get_method(ngx_http_request_t *r);
+
+    int ngx_http_lua_ffi_req_get_method_name(ngx_http_request_t *r,
+        unsigned char **name, size_t *len);
+
+    int ngx_http_lua_ffi_req_set_method(ngx_http_request_t *r, int method);
+
+    int ngx_http_lua_ffi_req_set_header(ngx_http_request_t *r,
+        const unsigned char *key, size_t key_len, const unsigned char *value,
+        size_t value_len, ngx_http_lua_ffi_str_t *mvals, size_t mvals_len,
+        int override, char **errmsg);
+]]
+
+
+local table_elt_type = ffi.typeof("ngx_http_lua_ffi_table_elt_t*")
+local table_elt_size = ffi.sizeof("ngx_http_lua_ffi_table_elt_t")
+local truncated = ffi.new("int[1]")
+
+local req_headers_mt = {
+    __index = function (tb, key)
+        return rawget(tb, (str_replace_char(lower(key), '_', '-')))
+    end
+}
+
+
+function ngx.req.get_headers(max_headers, raw)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if not max_headers then
+        max_headers = -1
+    end
+
+    if not raw then
+        raw = 0
+    else
+        raw = 1
+    end
+
+    local n = C.ngx_http_lua_ffi_req_get_headers_count(r, max_headers,
+                                                       truncated)
+    if n == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    if n == 0 then
+        local headers = {}
+        if raw == 0 then
+            headers = setmetatable(headers, req_headers_mt)
+        end
+
+        return headers
+    end
+
+    local raw_buf = get_string_buf(n * table_elt_size)
+    local buf = ffi_cast(table_elt_type, raw_buf)
+
+    local rc = C.ngx_http_lua_ffi_req_get_headers(r, buf, n, raw)
+    if rc == 0 then
+        local headers = new_tab(0, n)
+        for i = 0, n - 1 do
+            local h = buf[i]
+
+            local key = h.key
+            key = ffi_str(key.data, key.len)
+
+            local value = h.value
+            value = ffi_str(value.data, value.len)
+
+            local existing = headers[key]
+            if existing then
+                if type(existing) == "table" then
+                    existing[#existing + 1] = value
+                else
+                    headers[key] = {existing, value}
+                end
+
+            else
+                headers[key] = value
+            end
+        end
+
+        if raw == 0 then
+            headers = setmetatable(headers, req_headers_mt)
+        end
+
+        if truncated[0] ~= 0 then
+            return headers, "truncated"
+        end
+
+        return headers
+    end
+
+    return nil
+end
+
+
+function ngx.req.get_uri_args(max_args)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if not max_args then
+        max_args = -1
+    end
+
+    local n = C.ngx_http_lua_ffi_req_get_uri_args_count(r, max_args, truncated)
+    if n == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    if n == 0 then
+        return {}
+    end
+
+    local args_len = C.ngx_http_lua_ffi_req_get_querystring_len(r)
+
+    local strbuf = get_string_buf(args_len + n * table_elt_size)
+    local kvbuf = ffi_cast(table_elt_type, strbuf + args_len)
+
+    local nargs = C.ngx_http_lua_ffi_req_get_uri_args(r, strbuf, kvbuf, n)
+
+    local args = new_tab(0, nargs)
+    for i = 0, nargs - 1 do
+        local arg = kvbuf[i]
+
+        local key = arg.key
+        key = ffi_str(key.data, key.len)
+
+        local value = arg.value
+        local len = value.len
+        if len == -1 then
+            value = true
+        else
+            value = ffi_str(value.data, len)
+        end
+
+        local existing = args[key]
+        if existing then
+            if type(existing) == "table" then
+                existing[#existing + 1] = value
+            else
+                args[key] = {existing, value}
+            end
+
+        else
+            args[key] = value
+        end
+    end
+
+    if truncated[0] ~= 0 then
+        return args, "truncated"
+    end
+
+    return args
+end
+
+
+do
+    local methods = {
+        [0x0002] = "GET",
+        [0x0004] = "HEAD",
+        [0x0008] = "POST",
+        [0x0010] = "PUT",
+        [0x0020] = "DELETE",
+        [0x0040] = "MKCOL",
+        [0x0080] = "COPY",
+        [0x0100] = "MOVE",
+        [0x0200] = "OPTIONS",
+        [0x0400] = "PROPFIND",
+        [0x0800] = "PROPPATCH",
+        [0x1000] = "LOCK",
+        [0x2000] = "UNLOCK",
+        [0x4000] = "PATCH",
+        [0x8000] = "TRACE",
+    }
+
+    local namep = ffi_new("unsigned char *[1]")
+
+    function ngx.req.get_method()
+        local r = get_request()
+        if not r then
+            error("no request found")
+        end
+
+        do
+            local id = C.ngx_http_lua_ffi_req_get_method(r)
+            if id == FFI_BAD_CONTEXT then
+                error("API disabled in the current context", 2)
+            end
+
+            local method = methods[id]
+            if method then
+                return method
+            end
+        end
+
+        local sizep = get_size_ptr()
+        local rc = C.ngx_http_lua_ffi_req_get_method_name(r, namep, sizep)
+        if rc ~= 0 then
+            return nil
+        end
+
+        return ffi_str(namep[0], sizep[0])
+    end
+end  -- do
+
+
+function ngx.req.set_method(method)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if type(method) ~= "number" then
+        error("bad method number", 2)
+    end
+
+    local rc = C.ngx_http_lua_ffi_req_set_method(r, method)
+    if rc == FFI_OK then
+        return
+    end
+
+    if rc == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    if rc == FFI_DECLINED then
+        error("unsupported HTTP method: " .. method, 2)
+    end
+
+    error("unknown error: " .. rc)
+end
+
+
+do
+    local function set_req_header(name, value, override)
+        local r = get_request()
+        if not r then
+            error("no request found", 3)
+        end
+
+        if name == nil then
+            error("bad 'name' argument: string expected, got nil", 3)
+        end
+
+        if type(name) ~= "string" then
+            name = tostring(name)
+        end
+
+        local rc
+
+        if value == nil then
+            if not override then
+                error("bad 'value' argument: string or table expected, got nil",
+                      3)
+            end
+
+            rc = C.ngx_http_lua_ffi_req_set_header(r, name, #name, nil, 0, nil,
+                                                   0, 1, errmsg)
+
+        else
+            local sval, sval_len, mvals, mvals_len, buf
+            local value_type = type(value)
+
+            if value_type == "table" then
+                mvals_len = #value
+                if mvals_len == 0 and not override then
+                    error("bad 'value' argument: non-empty table expected", 3)
+                end
+
+                buf = get_string_buf(ffi_str_size * mvals_len)
+                mvals = ffi_cast(ffi_str_type, buf)
+
+                for i = 1, mvals_len do
+                    local s = value[i]
+                    if type(s) ~= "string" then
+                        s = tostring(s)
+                        value[i] = s
+                    end
+
+                    local str = mvals[i - 1]
+                    str.data = s
+                    str.len = #s
+                end
+
+                sval_len = 0
+
+            else
+                if value_type ~= "string" then
+                    sval = tostring(value)
+                else
+                    sval = value
+                end
+
+                sval_len = #sval
+                mvals_len = 0
+            end
+
+            rc = C.ngx_http_lua_ffi_req_set_header(r, name, #name, sval,
+                                                   sval_len, mvals, mvals_len,
+                                                   override and 1 or 0, errmsg)
+        end
+
+        if rc == FFI_OK or rc == FFI_DECLINED then
+            return
+        end
+
+        if rc == FFI_BAD_CONTEXT then
+            error("API disabled in the current context", 3)
+        end
+
+        -- rc == FFI_ERROR
+        error(ffi_str(errmsg[0]))
+    end
+
+
+    _M.set_req_header = set_req_header
+
+
+    function ngx.req.set_header(name, value)
+        set_req_header(name, value, true) -- override
+    end
+end  -- do
+
+
+function ngx.req.clear_header(name)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if type(name) ~= "string" then
+        name = tostring(name)
+    end
+
+    local rc = C.ngx_http_lua_ffi_req_set_header(r, name, #name, nil, 0, nil, 0,
+                                                 1, errmsg)
+
+    if rc == FFI_OK or rc == FFI_DECLINED then
+        return
+    end
+
+    if rc == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    -- rc == FFI_ERROR
+    error(ffi_str(errmsg[0]))
+end
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/response.lua

@@ -0,0 +1,183 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require 'ffi'
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_cast = ffi.cast
+local ffi_str = ffi.string
+local new_tab = base.new_tab
+local FFI_BAD_CONTEXT = base.FFI_BAD_CONTEXT
+local FFI_NO_REQ_CTX = base.FFI_NO_REQ_CTX
+local FFI_DECLINED = base.FFI_DECLINED
+local get_string_buf = base.get_string_buf
+local setmetatable = setmetatable
+local type = type
+local tostring = tostring
+local get_request = base.get_request
+local error = error
+local ngx = ngx
+
+
+local _M = {
+    version = base.version
+}
+
+
+local MAX_HEADER_VALUES = 100
+local errmsg = base.get_errmsg_ptr()
+local ffi_str_type = ffi.typeof("ngx_http_lua_ffi_str_t*")
+local ffi_str_size = ffi.sizeof("ngx_http_lua_ffi_str_t")
+
+
+ffi.cdef[[
+    int ngx_http_lua_ffi_set_resp_header(ngx_http_request_t *r,
+        const char *key_data, size_t key_len, int is_nil,
+        const char *sval, size_t sval_len, ngx_http_lua_ffi_str_t *mvals,
+        size_t mvals_len, int override, char **errmsg);
+
+    int ngx_http_lua_ffi_get_resp_header(ngx_http_request_t *r,
+        const unsigned char *key, size_t key_len,
+        unsigned char *key_buf, ngx_http_lua_ffi_str_t *values,
+        int max_nvalues, char **errmsg);
+]]
+
+
+local function set_resp_header(tb, key, value, no_override)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local rc
+    if value == nil then
+        if no_override then
+            error("invalid header value", 3)
+        end
+
+        rc = C.ngx_http_lua_ffi_set_resp_header(r, key, #key, true, nil, 0, nil,
+                                                0, 1, errmsg)
+    else
+        local sval, sval_len, mvals, mvals_len, buf
+
+        if type(value) == "table" then
+            mvals_len = #value
+            if mvals_len == 0 and no_override then
+                return
+            end
+
+            buf = get_string_buf(ffi_str_size * mvals_len)
+            mvals = ffi_cast(ffi_str_type, buf)
+            for i = 1, mvals_len do
+                local s = value[i]
+                if type(s) ~= "string" then
+                    s = tostring(s)
+                    value[i] = s
+                end
+                local str = mvals[i - 1]
+                str.data = s
+                str.len = #s
+            end
+
+            sval_len = 0
+
+        else
+            if type(value) ~= "string" then
+                sval = tostring(value)
+            else
+                sval = value
+            end
+            sval_len = #sval
+
+            mvals_len = 0
+        end
+
+        local override_int = no_override and 0 or 1
+        rc = C.ngx_http_lua_ffi_set_resp_header(r, key, #key, false, sval,
+                                                sval_len, mvals, mvals_len,
+                                                override_int, errmsg)
+    end
+
+    if rc == 0 or rc == FFI_DECLINED then
+        return
+    end
+
+    if rc == FFI_NO_REQ_CTX then
+        error("no request ctx found")
+    end
+
+    if rc == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    -- rc == FFI_ERROR
+    error(ffi_str(errmsg[0]), 2)
+end
+
+
+_M.set_resp_header = set_resp_header
+
+
+local function get_resp_header(tb, key)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+
+    local key_buf = get_string_buf(key_len + ffi_str_size * MAX_HEADER_VALUES)
+    local values = ffi_cast(ffi_str_type, key_buf + key_len)
+    local n = C.ngx_http_lua_ffi_get_resp_header(r, key, key_len, key_buf,
+                                                 values, MAX_HEADER_VALUES,
+                                                 errmsg)
+
+    -- print("retval: ", n)
+
+    if n == FFI_BAD_CONTEXT then
+        error("API disabled in the current context", 2)
+    end
+
+    if n == 0 then
+        return nil
+    end
+
+    if n == 1 then
+        local v = values[0]
+        return ffi_str(v.data, v.len)
+    end
+
+    if n > 0 then
+        local ret = new_tab(n, 0)
+        for i = 1, n do
+            local v = values[i - 1]
+            ret[i] = ffi_str(v.data, v.len)
+        end
+        return ret
+    end
+
+    -- n == FFI_ERROR
+    error(ffi_str(errmsg[0]), 2)
+end
+
+
+do
+    local mt = new_tab(0, 2)
+    mt.__newindex = set_resp_header
+    mt.__index = get_resp_header
+
+    ngx.header = setmetatable(new_tab(0, 0), mt)
+end
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/shdict.lua

@@ -0,0 +1,638 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require 'ffi'
+local base = require "resty.core.base"
+
+
+local _M = {
+    version = base.version
+}
+
+local ngx_shared = ngx.shared
+if not ngx_shared then
+    return _M
+end
+
+
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local C = ffi.C
+local get_string_buf = base.get_string_buf
+local get_string_buf_size = base.get_string_buf_size
+local get_size_ptr = base.get_size_ptr
+local tonumber = tonumber
+local tostring = tostring
+local next = next
+local type = type
+local error = error
+local getmetatable = getmetatable
+local FFI_DECLINED = base.FFI_DECLINED
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_shdict_get
+local ngx_lua_ffi_shdict_incr
+local ngx_lua_ffi_shdict_store
+local ngx_lua_ffi_shdict_flush_all
+local ngx_lua_ffi_shdict_get_ttl
+local ngx_lua_ffi_shdict_set_expire
+local ngx_lua_ffi_shdict_capacity
+local ngx_lua_ffi_shdict_free_space
+local ngx_lua_ffi_shdict_udata_to_zone
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+int ngx_http_lua_ffi_shdict_get(void *zone, const unsigned char *key,
+    size_t key_len, int *value_type, unsigned char **str_value_buf,
+    size_t *str_value_len, double *num_value, int *user_flags,
+    int get_stale, int *is_stale, char **errmsg);
+
+int ngx_http_lua_ffi_shdict_incr(void *zone, const unsigned char *key,
+    size_t key_len, double *value, char **err, int has_init,
+    double init, long init_ttl, int *forcible);
+
+int ngx_http_lua_ffi_shdict_store(void *zone, int op,
+    const unsigned char *key, size_t key_len, int value_type,
+    const unsigned char *str_value_buf, size_t str_value_len,
+    double num_value, long exptime, int user_flags, char **errmsg,
+    int *forcible);
+
+int ngx_http_lua_ffi_shdict_flush_all(void *zone);
+
+long ngx_http_lua_ffi_shdict_get_ttl(void *zone,
+    const unsigned char *key, size_t key_len);
+
+int ngx_http_lua_ffi_shdict_set_expire(void *zone,
+    const unsigned char *key, size_t key_len, long exptime);
+
+size_t ngx_http_lua_ffi_shdict_capacity(void *zone);
+
+void *ngx_http_lua_ffi_shdict_udata_to_zone(void *zone_udata);
+    ]]
+
+    ngx_lua_ffi_shdict_get = C.ngx_http_lua_ffi_shdict_get
+    ngx_lua_ffi_shdict_incr = C.ngx_http_lua_ffi_shdict_incr
+    ngx_lua_ffi_shdict_store = C.ngx_http_lua_ffi_shdict_store
+    ngx_lua_ffi_shdict_flush_all = C.ngx_http_lua_ffi_shdict_flush_all
+    ngx_lua_ffi_shdict_get_ttl = C.ngx_http_lua_ffi_shdict_get_ttl
+    ngx_lua_ffi_shdict_set_expire = C.ngx_http_lua_ffi_shdict_set_expire
+    ngx_lua_ffi_shdict_capacity = C.ngx_http_lua_ffi_shdict_capacity
+    ngx_lua_ffi_shdict_udata_to_zone =
+        C.ngx_http_lua_ffi_shdict_udata_to_zone
+
+    if not pcall(function ()
+        return C.ngx_http_lua_ffi_shdict_free_space
+    end)
+    then
+        ffi.cdef[[
+size_t ngx_http_lua_ffi_shdict_free_space(void *zone);
+        ]]
+    end
+
+    pcall(function ()
+        ngx_lua_ffi_shdict_free_space = C.ngx_http_lua_ffi_shdict_free_space
+    end)
+
+elseif subsystem == 'stream' then
+
+    ffi.cdef[[
+int ngx_stream_lua_ffi_shdict_get(void *zone, const unsigned char *key,
+    size_t key_len, int *value_type, unsigned char **str_value_buf,
+    size_t *str_value_len, double *num_value, int *user_flags,
+    int get_stale, int *is_stale, char **errmsg);
+
+int ngx_stream_lua_ffi_shdict_incr(void *zone, const unsigned char *key,
+    size_t key_len, double *value, char **err, int has_init,
+    double init, long init_ttl, int *forcible);
+
+int ngx_stream_lua_ffi_shdict_store(void *zone, int op,
+    const unsigned char *key, size_t key_len, int value_type,
+    const unsigned char *str_value_buf, size_t str_value_len,
+    double num_value, long exptime, int user_flags, char **errmsg,
+    int *forcible);
+
+int ngx_stream_lua_ffi_shdict_flush_all(void *zone);
+
+long ngx_stream_lua_ffi_shdict_get_ttl(void *zone,
+     const unsigned char *key, size_t key_len);
+
+int ngx_stream_lua_ffi_shdict_set_expire(void *zone,
+    const unsigned char *key, size_t key_len, long exptime);
+
+size_t ngx_stream_lua_ffi_shdict_capacity(void *zone);
+
+void *ngx_stream_lua_ffi_shdict_udata_to_zone(void *zone_udata);
+    ]]
+
+    ngx_lua_ffi_shdict_get = C.ngx_stream_lua_ffi_shdict_get
+    ngx_lua_ffi_shdict_incr = C.ngx_stream_lua_ffi_shdict_incr
+    ngx_lua_ffi_shdict_store = C.ngx_stream_lua_ffi_shdict_store
+    ngx_lua_ffi_shdict_flush_all = C.ngx_stream_lua_ffi_shdict_flush_all
+    ngx_lua_ffi_shdict_get_ttl = C.ngx_stream_lua_ffi_shdict_get_ttl
+    ngx_lua_ffi_shdict_set_expire = C.ngx_stream_lua_ffi_shdict_set_expire
+    ngx_lua_ffi_shdict_capacity = C.ngx_stream_lua_ffi_shdict_capacity
+    ngx_lua_ffi_shdict_udata_to_zone =
+        C.ngx_stream_lua_ffi_shdict_udata_to_zone
+
+    if not pcall(function ()
+        return C.ngx_stream_lua_ffi_shdict_free_space
+    end)
+    then
+        ffi.cdef[[
+size_t ngx_stream_lua_ffi_shdict_free_space(void *zone);
+        ]]
+    end
+
+    -- ngx_stream_lua is only compatible with NGINX >= 1.13.6, meaning it
+    -- cannot lack support for ngx_stream_lua_ffi_shdict_free_space.
+    ngx_lua_ffi_shdict_free_space = C.ngx_stream_lua_ffi_shdict_free_space
+
+else
+    error("unknown subsystem: " .. subsystem)
+end
+
+if not pcall(function () return C.free end) then
+    ffi.cdef[[
+void free(void *ptr);
+    ]]
+end
+
+
+local value_type = ffi_new("int[1]")
+local user_flags = ffi_new("int[1]")
+local num_value = ffi_new("double[1]")
+local is_stale = ffi_new("int[1]")
+local forcible = ffi_new("int[1]")
+local str_value_buf = ffi_new("unsigned char *[1]")
+local errmsg = base.get_errmsg_ptr()
+
+
+local function check_zone(zone)
+    if not zone or type(zone) ~= "table" then
+        error("bad \"zone\" argument", 3)
+    end
+
+    zone = zone[1]
+    if type(zone) ~= "userdata" then
+        error("bad \"zone\" argument", 3)
+    end
+
+    zone = ngx_lua_ffi_shdict_udata_to_zone(zone)
+    if zone == nil then
+        error("bad \"zone\" argument", 3)
+    end
+
+    return zone
+end
+
+
+local function shdict_store(zone, op, key, value, exptime, flags)
+    zone = check_zone(zone)
+
+    if not exptime then
+        exptime = 0
+    elseif exptime < 0 then
+        error('bad "exptime" argument', 2)
+    end
+
+    if not flags then
+        flags = 0
+    end
+
+    if key == nil then
+        return nil, "nil key"
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+    if key_len == 0 then
+        return nil, "empty key"
+    end
+    if key_len > 65535 then
+        return nil, "key too long"
+    end
+
+    local str_val_buf
+    local str_val_len = 0
+    local num_val = 0
+    local valtyp = type(value)
+
+    -- print("value type: ", valtyp)
+    -- print("exptime: ", exptime)
+
+    if valtyp == "string" then
+        valtyp = 4  -- LUA_TSTRING
+        str_val_buf = value
+        str_val_len = #value
+
+    elseif valtyp == "number" then
+        valtyp = 3  -- LUA_TNUMBER
+        num_val = value
+
+    elseif value == nil then
+        valtyp = 0  -- LUA_TNIL
+
+    elseif valtyp == "boolean" then
+        valtyp = 1  -- LUA_TBOOLEAN
+        num_val = value and 1 or 0
+
+    else
+        return nil, "bad value type"
+    end
+
+    local rc = ngx_lua_ffi_shdict_store(zone, op, key, key_len,
+                                        valtyp, str_val_buf,
+                                        str_val_len, num_val,
+                                        exptime * 1000, flags, errmsg,
+                                        forcible)
+
+    -- print("rc == ", rc)
+
+    if rc == 0 then  -- NGX_OK
+        return true, nil, forcible[0] == 1
+    end
+
+    -- NGX_DECLINED or NGX_ERROR
+    return false, ffi_str(errmsg[0]), forcible[0] == 1
+end
+
+
+local function shdict_set(zone, key, value, exptime, flags)
+    return shdict_store(zone, 0, key, value, exptime, flags)
+end
+
+
+local function shdict_safe_set(zone, key, value, exptime, flags)
+    return shdict_store(zone, 0x0004, key, value, exptime, flags)
+end
+
+
+local function shdict_add(zone, key, value, exptime, flags)
+    return shdict_store(zone, 0x0001, key, value, exptime, flags)
+end
+
+
+local function shdict_safe_add(zone, key, value, exptime, flags)
+    return shdict_store(zone, 0x0005, key, value, exptime, flags)
+end
+
+
+local function shdict_replace(zone, key, value, exptime, flags)
+    return shdict_store(zone, 0x0002, key, value, exptime, flags)
+end
+
+
+local function shdict_delete(zone, key)
+    return shdict_set(zone, key, nil)
+end
+
+
+local function shdict_get(zone, key)
+    zone = check_zone(zone)
+
+    if key == nil then
+        return nil, "nil key"
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+    if key_len == 0 then
+        return nil, "empty key"
+    end
+    if key_len > 65535 then
+        return nil, "key too long"
+    end
+
+    local size = get_string_buf_size()
+    local buf = get_string_buf(size)
+    str_value_buf[0] = buf
+    local value_len = get_size_ptr()
+    value_len[0] = size
+
+    local rc = ngx_lua_ffi_shdict_get(zone, key, key_len, value_type,
+                                      str_value_buf, value_len,
+                                      num_value, user_flags, 0,
+                                      is_stale, errmsg)
+    if rc ~= 0 then
+        if errmsg[0] ~= nil then
+            return nil, ffi_str(errmsg[0])
+        end
+
+        error("failed to get the key")
+    end
+
+    local typ = value_type[0]
+
+    if typ == 0 then -- LUA_TNIL
+        return nil
+    end
+
+    local flags = tonumber(user_flags[0])
+
+    local val
+
+    if typ == 4 then -- LUA_TSTRING
+        if str_value_buf[0] ~= buf then
+            -- ngx.say("len: ", tonumber(value_len[0]))
+            buf = str_value_buf[0]
+            val = ffi_str(buf, value_len[0])
+            C.free(buf)
+        else
+            val = ffi_str(buf, value_len[0])
+        end
+
+    elseif typ == 3 then -- LUA_TNUMBER
+        val = tonumber(num_value[0])
+
+    elseif typ == 1 then -- LUA_TBOOLEAN
+        val = (tonumber(buf[0]) ~= 0)
+
+    else
+        error("unknown value type: " .. typ)
+    end
+
+    if flags ~= 0 then
+        return val, flags
+    end
+
+    return val
+end
+
+
+local function shdict_get_stale(zone, key)
+    zone = check_zone(zone)
+
+    if key == nil then
+        return nil, "nil key"
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+    if key_len == 0 then
+        return nil, "empty key"
+    end
+    if key_len > 65535 then
+        return nil, "key too long"
+    end
+
+    local size = get_string_buf_size()
+    local buf = get_string_buf(size)
+    str_value_buf[0] = buf
+    local value_len = get_size_ptr()
+    value_len[0] = size
+
+    local rc = ngx_lua_ffi_shdict_get(zone, key, key_len, value_type,
+                                      str_value_buf, value_len,
+                                      num_value, user_flags, 1,
+                                      is_stale, errmsg)
+    if rc ~= 0 then
+        if errmsg[0] ~= nil then
+            return nil, ffi_str(errmsg[0])
+        end
+
+        error("failed to get the key")
+    end
+
+    local typ = value_type[0]
+
+    if typ == 0 then -- LUA_TNIL
+        return nil
+    end
+
+    local flags = tonumber(user_flags[0])
+    local val
+
+    if typ == 4 then -- LUA_TSTRING
+        if str_value_buf[0] ~= buf then
+            -- ngx.say("len: ", tonumber(value_len[0]))
+            buf = str_value_buf[0]
+            val = ffi_str(buf, value_len[0])
+            C.free(buf)
+        else
+            val = ffi_str(buf, value_len[0])
+        end
+
+    elseif typ == 3 then -- LUA_TNUMBER
+        val = tonumber(num_value[0])
+
+    elseif typ == 1 then -- LUA_TBOOLEAN
+        val = (tonumber(buf[0]) ~= 0)
+
+    else
+        error("unknown value type: " .. typ)
+    end
+
+    if flags ~= 0 then
+        return val, flags, is_stale[0] == 1
+    end
+
+    return val, nil, is_stale[0] == 1
+end
+
+
+local function shdict_incr(zone, key, value, init, init_ttl)
+    zone = check_zone(zone)
+
+    if key == nil then
+        return nil, "nil key"
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+    if key_len == 0 then
+        return nil, "empty key"
+    end
+    if key_len > 65535 then
+        return nil, "key too long"
+    end
+
+    if type(value) ~= "number" then
+        value = tonumber(value)
+    end
+    num_value[0] = value
+
+    if init then
+        local typ = type(init)
+        if typ ~= "number" then
+            init = tonumber(init)
+
+            if not init then
+                error("bad init arg: number expected, got " .. typ, 2)
+            end
+        end
+    end
+
+    if init_ttl ~= nil then
+        local typ = type(init_ttl)
+        if typ ~= "number" then
+            init_ttl = tonumber(init_ttl)
+
+            if not init_ttl then
+                error("bad init_ttl arg: number expected, got " .. typ, 2)
+            end
+        end
+
+        if init_ttl < 0 then
+            error('bad "init_ttl" argument', 2)
+        end
+
+        if not init then
+            error('must provide "init" when providing "init_ttl"', 2)
+        end
+
+    else
+        init_ttl = 0
+    end
+
+    local rc = ngx_lua_ffi_shdict_incr(zone, key, key_len, num_value,
+                                       errmsg, init and 1 or 0,
+                                       init or 0, init_ttl * 1000,
+                                       forcible)
+    if rc ~= 0 then  -- ~= NGX_OK
+        return nil, ffi_str(errmsg[0])
+    end
+
+    if not init then
+        return tonumber(num_value[0])
+    end
+
+    return tonumber(num_value[0]), nil, forcible[0] == 1
+end
+
+
+local function shdict_flush_all(zone)
+    zone = check_zone(zone)
+
+    ngx_lua_ffi_shdict_flush_all(zone)
+end
+
+
+local function shdict_ttl(zone, key)
+    zone = check_zone(zone)
+
+    if key == nil then
+        return nil, "nil key"
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+    if key_len == 0 then
+        return nil, "empty key"
+    end
+
+    if key_len > 65535 then
+        return nil, "key too long"
+    end
+
+    local rc = ngx_lua_ffi_shdict_get_ttl(zone, key, key_len)
+
+    if rc == FFI_DECLINED then
+        return nil, "not found"
+    end
+
+    return tonumber(rc) / 1000
+end
+
+
+local function shdict_expire(zone, key, exptime)
+    zone = check_zone(zone)
+
+    if not exptime then
+        error('bad "exptime" argument', 2)
+    end
+
+    if key == nil then
+        return nil, "nil key"
+    end
+
+    if type(key) ~= "string" then
+        key = tostring(key)
+    end
+
+    local key_len = #key
+    if key_len == 0 then
+        return nil, "empty key"
+    end
+
+    if key_len > 65535 then
+        return nil, "key too long"
+    end
+
+    local rc = ngx_lua_ffi_shdict_set_expire(zone, key, key_len,
+                                             exptime * 1000)
+
+    if rc == FFI_DECLINED then
+        return nil, "not found"
+    end
+
+    -- NGINX_OK/FFI_OK
+
+    return true
+end
+
+
+local function shdict_capacity(zone)
+    zone = check_zone(zone)
+
+    return tonumber(ngx_lua_ffi_shdict_capacity(zone))
+end
+
+
+local shdict_free_space
+if ngx_lua_ffi_shdict_free_space then
+    shdict_free_space = function (zone)
+        zone = check_zone(zone)
+
+        return tonumber(ngx_lua_ffi_shdict_free_space(zone))
+    end
+
+else
+    shdict_free_space = function ()
+        error("'shm:free_space()' not supported in NGINX < 1.11.7", 2)
+    end
+end
+
+
+local _, dict = next(ngx_shared, nil)
+if dict then
+    local mt = getmetatable(dict)
+    if mt then
+        mt = mt.__index
+        if mt then
+            mt.get = shdict_get
+            mt.get_stale = shdict_get_stale
+            mt.incr = shdict_incr
+            mt.set = shdict_set
+            mt.safe_set = shdict_safe_set
+            mt.add = shdict_add
+            mt.safe_add = shdict_safe_add
+            mt.replace = shdict_replace
+            mt.delete = shdict_delete
+            mt.flush_all = shdict_flush_all
+            mt.ttl = shdict_ttl
+            mt.expire = shdict_expire
+            mt.capacity = shdict_capacity
+            mt.free_space = shdict_free_space
+        end
+    end
+end
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/socket.lua

@@ -0,0 +1,124 @@
+local base = require "resty.core.base"
+base.allows_subsystem('http')
+local debug = require 'debug'
+local ffi = require 'ffi'
+
+
+local error = error
+local tonumber = tonumber
+local registry = debug.getregistry()
+local ffi_new = ffi.new
+local ffi_string = ffi.string
+local C = ffi.C
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local tostring = tostring
+
+
+local option_index = {
+    ["keepalive"]   = 1,
+    ["reuseaddr"]   = 2,
+    ["tcp-nodelay"] = 3,
+    ["sndbuf"]      = 4,
+    ["rcvbuf"]      = 5,
+}
+
+
+ffi.cdef[[
+typedef struct ngx_http_lua_socket_tcp_upstream_s
+    ngx_http_lua_socket_tcp_upstream_t;
+
+int
+ngx_http_lua_ffi_socket_tcp_getoption(ngx_http_lua_socket_tcp_upstream_t *u,
+    int opt, int *val, unsigned char *err, size_t *errlen);
+
+int
+ngx_http_lua_ffi_socket_tcp_setoption(ngx_http_lua_socket_tcp_upstream_t *u,
+    int opt, int val, unsigned char *err, size_t *errlen);
+]]
+
+
+local output_value_buf = ffi_new("int[1]")
+local FFI_OK = base.FFI_OK
+local SOCKET_CTX_INDEX = 1
+local ERR_BUF_SIZE = 4096
+
+
+local function get_tcp_socket(cosocket)
+    local tcp_socket = cosocket[SOCKET_CTX_INDEX]
+    if not tcp_socket then
+        error("socket is never created nor connected")
+    end
+
+    return tcp_socket
+end
+
+
+local function getoption(cosocket, option)
+    local tcp_socket = get_tcp_socket(cosocket)
+
+    if option == nil then
+        return nil, 'missing the "option" argument'
+    end
+
+    if option_index[option] == nil then
+        return nil, "unsupported option " .. tostring(option)
+    end
+
+    local err = get_string_buf(ERR_BUF_SIZE)
+    local errlen = get_size_ptr()
+    errlen[0] = ERR_BUF_SIZE
+
+    local rc = C.ngx_http_lua_ffi_socket_tcp_getoption(tcp_socket,
+                                                       option_index[option],
+                                                       output_value_buf,
+                                                       err,
+                                                       errlen)
+    if rc ~= FFI_OK then
+        return nil, ffi_string(err, errlen[0])
+    end
+
+    return tonumber(output_value_buf[0])
+end
+
+
+local function setoption(cosocket, option, value)
+    local tcp_socket = get_tcp_socket(cosocket)
+
+    if option == nil then
+        return nil, 'missing the "option" argument'
+    end
+
+    if value == nil then
+        return nil, 'missing the "value" argument'
+    end
+
+    if option_index[option] == nil then
+        return nil, "unsupported option " .. tostring(option)
+    end
+
+    local err = get_string_buf(ERR_BUF_SIZE)
+    local errlen = get_size_ptr()
+    errlen[0] = ERR_BUF_SIZE
+
+    local rc = C.ngx_http_lua_ffi_socket_tcp_setoption(tcp_socket,
+                                                       option_index[option],
+                                                       value,
+                                                       err,
+                                                       errlen)
+    if rc ~= FFI_OK then
+        return nil, ffi_string(err, errlen[0])
+    end
+
+    return true
+end
+
+
+do
+    local method_table = registry.__tcp_cosocket_mt
+    method_table.getoption = getoption
+    method_table.setoption = setoption
+end
+
+
+return { version = base.version }

deps/src/lua-resty-core/lib/resty/core/time.lua

@@ -0,0 +1,159 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require 'ffi'
+local base = require "resty.core.base"
+
+
+local error = error
+local tonumber = tonumber
+local type = type
+local C = ffi.C
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local time_val = ffi_new("long[1]")
+local get_string_buf = base.get_string_buf
+local ngx = ngx
+local FFI_ERROR = base.FFI_ERROR
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_now
+local ngx_lua_ffi_time
+local ngx_lua_ffi_today
+local ngx_lua_ffi_localtime
+local ngx_lua_ffi_utctime
+local ngx_lua_ffi_update_time
+
+
+if subsystem == 'http' then
+    ffi.cdef[[
+double ngx_http_lua_ffi_now(void);
+long ngx_http_lua_ffi_time(void);
+void ngx_http_lua_ffi_today(unsigned char *buf);
+void ngx_http_lua_ffi_localtime(unsigned char *buf);
+void ngx_http_lua_ffi_utctime(unsigned char *buf);
+void ngx_http_lua_ffi_update_time(void);
+int ngx_http_lua_ffi_cookie_time(unsigned char *buf, long t);
+void ngx_http_lua_ffi_http_time(unsigned char *buf, long t);
+void ngx_http_lua_ffi_parse_http_time(const unsigned char *str, size_t len,
+    long *time);
+    ]]
+
+    ngx_lua_ffi_now = C.ngx_http_lua_ffi_now
+    ngx_lua_ffi_time = C.ngx_http_lua_ffi_time
+    ngx_lua_ffi_today = C.ngx_http_lua_ffi_today
+    ngx_lua_ffi_localtime = C.ngx_http_lua_ffi_localtime
+    ngx_lua_ffi_utctime = C.ngx_http_lua_ffi_utctime
+    ngx_lua_ffi_update_time = C.ngx_http_lua_ffi_update_time
+
+elseif subsystem == 'stream' then
+    ffi.cdef[[
+double ngx_stream_lua_ffi_now(void);
+long ngx_stream_lua_ffi_time(void);
+void ngx_stream_lua_ffi_today(unsigned char *buf);
+void ngx_stream_lua_ffi_localtime(unsigned char *buf);
+void ngx_stream_lua_ffi_utctime(unsigned char *buf);
+void ngx_stream_lua_ffi_update_time(void);
+    ]]
+
+    ngx_lua_ffi_now = C.ngx_stream_lua_ffi_now
+    ngx_lua_ffi_time = C.ngx_stream_lua_ffi_time
+    ngx_lua_ffi_today = C.ngx_stream_lua_ffi_today
+    ngx_lua_ffi_localtime = C.ngx_stream_lua_ffi_localtime
+    ngx_lua_ffi_utctime = C.ngx_stream_lua_ffi_utctime
+    ngx_lua_ffi_update_time = C.ngx_stream_lua_ffi_update_time
+end
+
+
+function ngx.now()
+    return tonumber(ngx_lua_ffi_now())
+end
+
+
+function ngx.time()
+    return tonumber(ngx_lua_ffi_time())
+end
+
+
+function ngx.update_time()
+    ngx_lua_ffi_update_time()
+end
+
+
+function ngx.today()
+    -- the format of today is 2010-11-19
+    local today_buf_size = 10
+    local buf = get_string_buf(today_buf_size)
+    ngx_lua_ffi_today(buf)
+    return ffi_str(buf, today_buf_size)
+end
+
+
+function ngx.localtime()
+    -- the format of localtime is 2010-11-19 20:56:31
+    local localtime_buf_size = 19
+    local buf = get_string_buf(localtime_buf_size)
+    ngx_lua_ffi_localtime(buf)
+    return ffi_str(buf, localtime_buf_size)
+end
+
+
+function ngx.utctime()
+    -- the format of utctime is 2010-11-19 20:56:31
+    local utctime_buf_size = 19
+    local buf = get_string_buf(utctime_buf_size)
+    ngx_lua_ffi_utctime(buf)
+    return ffi_str(buf, utctime_buf_size)
+end
+
+
+if subsystem == 'http' then
+
+function ngx.cookie_time(sec)
+    if type(sec) ~= "number" then
+        error("number argument only", 2)
+    end
+
+    -- the format of cookie time is Mon, 28-Sep-2038 06:00:00 GMT
+    -- or Mon, 28-Sep-18 06:00:00 GMT
+    local cookie_time_buf_size = 29
+    local buf = get_string_buf(cookie_time_buf_size)
+    local used_size = C.ngx_http_lua_ffi_cookie_time(buf, sec)
+    return ffi_str(buf, used_size)
+end
+
+
+function ngx.http_time(sec)
+    if type(sec) ~= "number" then
+        error("number argument only", 2)
+    end
+
+    -- the format of http time is Mon, 28 Sep 1970 06:00:00 GMT
+    local http_time_buf_size = 29
+    local buf = get_string_buf(http_time_buf_size)
+    C.ngx_http_lua_ffi_http_time(buf, sec)
+    return ffi_str(buf, http_time_buf_size)
+end
+
+
+function ngx.parse_http_time(time_str)
+    if type(time_str) ~= "string" then
+        error("string argument only", 2)
+    end
+
+    C.ngx_http_lua_ffi_parse_http_time(time_str, #time_str, time_val)
+
+    local res = time_val[0]
+    if res == FFI_ERROR then
+        return nil
+    end
+
+    return tonumber(res)
+end
+
+end
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/uri.lua

@@ -0,0 +1,115 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_string = ffi.string
+local ngx = ngx
+local type = type
+local error = error
+local tostring = tostring
+local get_string_buf = base.get_string_buf
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_escape_uri
+local ngx_lua_ffi_unescape_uri
+local ngx_lua_ffi_uri_escaped_length
+
+local NGX_ESCAPE_URI = 0
+local NGX_ESCAPE_URI_COMPONENT = 2
+local NGX_ESCAPE_MAIL_AUTH = 6
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    size_t ngx_http_lua_ffi_uri_escaped_length(const unsigned char *src,
+                                               size_t len, int type);
+
+    void ngx_http_lua_ffi_escape_uri(const unsigned char *src, size_t len,
+                                     unsigned char *dst, int type);
+
+    size_t ngx_http_lua_ffi_unescape_uri(const unsigned char *src,
+                                         size_t len, unsigned char *dst);
+    ]]
+
+    ngx_lua_ffi_escape_uri = C.ngx_http_lua_ffi_escape_uri
+    ngx_lua_ffi_unescape_uri = C.ngx_http_lua_ffi_unescape_uri
+    ngx_lua_ffi_uri_escaped_length = C.ngx_http_lua_ffi_uri_escaped_length
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    size_t ngx_stream_lua_ffi_uri_escaped_length(const unsigned char *src,
+                                                 size_t len, int type);
+
+    void ngx_stream_lua_ffi_escape_uri(const unsigned char *src, size_t len,
+                                       unsigned char *dst, int type);
+
+    size_t ngx_stream_lua_ffi_unescape_uri(const unsigned char *src,
+                                           size_t len, unsigned char *dst);
+    ]]
+
+    ngx_lua_ffi_escape_uri = C.ngx_stream_lua_ffi_escape_uri
+    ngx_lua_ffi_unescape_uri = C.ngx_stream_lua_ffi_unescape_uri
+    ngx_lua_ffi_uri_escaped_length = C.ngx_stream_lua_ffi_uri_escaped_length
+end
+
+
+ngx.escape_uri = function (s, esc_type)
+    if type(s) ~= 'string' then
+        if not s then
+            s = ''
+
+        else
+            s = tostring(s)
+        end
+    end
+
+    if esc_type == nil then
+        esc_type = NGX_ESCAPE_URI_COMPONENT
+
+    else
+        if type(esc_type) ~= 'number' then
+            error("\"type\" is not a number", 3)
+        end
+
+        if esc_type < NGX_ESCAPE_URI or esc_type > NGX_ESCAPE_MAIL_AUTH then
+            error("\"type\" " .. esc_type .. " out of range", 3)
+        end
+    end
+
+    local slen = #s
+    local dlen = ngx_lua_ffi_uri_escaped_length(s, slen, esc_type)
+
+    -- print("dlen: ", tonumber(dlen))
+    if dlen == slen then
+        return s
+    end
+    local dst = get_string_buf(dlen)
+    ngx_lua_ffi_escape_uri(s, slen, dst, esc_type)
+    return ffi_string(dst, dlen)
+end
+
+
+ngx.unescape_uri = function (s)
+    if type(s) ~= 'string' then
+        if not s then
+            s = ''
+        else
+            s = tostring(s)
+        end
+    end
+    local slen = #s
+    local dlen = slen
+    local dst = get_string_buf(dlen)
+    dlen = ngx_lua_ffi_unescape_uri(s, slen, dst)
+    return ffi_string(dst, dlen)
+end
+
+
+return {
+    version = base.version,
+}

deps/src/lua-resty-core/lib/resty/core/utils.lua

@@ -0,0 +1,46 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_str = ffi.string
+local ffi_copy = ffi.copy
+local byte = string.byte
+local str_find = string.find
+local get_string_buf = base.get_string_buf
+local subsystem = ngx.config.subsystem
+
+
+local _M = {
+    version = base.version
+}
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    void ngx_http_lua_ffi_str_replace_char(unsigned char *buf, size_t len,
+        const unsigned char find, const unsigned char replace);
+    ]]
+
+
+    function _M.str_replace_char(str, find, replace)
+        if not str_find(str, find, nil, true) then
+            return str
+        end
+
+        local len = #str
+        local buf = get_string_buf(len)
+        ffi_copy(buf, str, len)
+
+        C.ngx_http_lua_ffi_str_replace_char(buf, len, byte(find),
+                                            byte(replace))
+
+        return ffi_str(buf, len)
+    end
+end
+
+
+return _M

deps/src/lua-resty-core/lib/resty/core/var.lua

@@ -0,0 +1,160 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local ffi_new = ffi.new
+local ffi_str = ffi.string
+local type = type
+local error = error
+local tostring = tostring
+local setmetatable = setmetatable
+local get_request = base.get_request
+local get_string_buf = base.get_string_buf
+local get_size_ptr = base.get_size_ptr
+local new_tab = base.new_tab
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_var_get
+local ngx_lua_ffi_var_set
+
+
+local ERR_BUF_SIZE = 256
+
+
+ngx.var = new_tab(0, 0)
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_var_get(ngx_http_request_t *r,
+        const char *name_data, size_t name_len, char *lowcase_buf,
+        int capture_id, char **value, size_t *value_len, char **err);
+
+    int ngx_http_lua_ffi_var_set(ngx_http_request_t *r,
+        const unsigned char *name_data, size_t name_len,
+        unsigned char *lowcase_buf, const unsigned char *value,
+        size_t value_len, unsigned char *errbuf, size_t *errlen);
+    ]]
+
+    ngx_lua_ffi_var_get = C.ngx_http_lua_ffi_var_get
+    ngx_lua_ffi_var_set = C.ngx_http_lua_ffi_var_set
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_var_get(ngx_stream_lua_request_t *r,
+        const char *name_data, size_t name_len, char *lowcase_buf,
+        int capture_id, char **value, size_t *value_len, char **err);
+
+    int ngx_stream_lua_ffi_var_set(ngx_stream_lua_request_t *r,
+        const unsigned char *name_data, size_t name_len,
+        unsigned char *lowcase_buf, const unsigned char *value,
+        size_t value_len, unsigned char *errbuf, size_t *errlen);
+    ]]
+
+    ngx_lua_ffi_var_get = C.ngx_stream_lua_ffi_var_get
+    ngx_lua_ffi_var_set = C.ngx_stream_lua_ffi_var_set
+end
+
+
+local value_ptr = ffi_new("unsigned char *[1]")
+local errmsg = base.get_errmsg_ptr()
+
+
+local function var_get(self, name)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    local value_len = get_size_ptr()
+    local rc
+    if type(name) == "number" then
+        rc = ngx_lua_ffi_var_get(r, nil, 0, nil, name, value_ptr, value_len,
+                                 errmsg)
+
+    else
+        if type(name) ~= "string" then
+            error("bad variable name", 2)
+        end
+
+        local name_len = #name
+        local lowcase_buf = get_string_buf(name_len)
+
+        rc = ngx_lua_ffi_var_get(r, name, name_len, lowcase_buf, 0, value_ptr,
+                                 value_len, errmsg)
+    end
+
+    -- ngx.log(ngx.WARN, "rc = ", rc)
+
+    if rc == 0 then -- NGX_OK
+        return ffi_str(value_ptr[0], value_len[0])
+    end
+
+    if rc == -5 then  -- NGX_DECLINED
+        return nil
+    end
+
+    if rc == -1 then  -- NGX_ERROR
+        error(ffi_str(errmsg[0]), 2)
+    end
+end
+
+
+local function var_set(self, name, value)
+    local r = get_request()
+    if not r then
+        error("no request found")
+    end
+
+    if type(name) ~= "string" then
+        error("bad variable name", 2)
+    end
+    local name_len = #name
+
+    local errlen = get_size_ptr()
+    errlen[0] = ERR_BUF_SIZE
+    local lowcase_buf = get_string_buf(name_len + ERR_BUF_SIZE)
+
+    local value_len
+    if value == nil then
+        value_len = 0
+    else
+        if type(value) ~= 'string' then
+            value = tostring(value)
+        end
+        value_len = #value
+    end
+
+    local errbuf = lowcase_buf + name_len
+    local rc = ngx_lua_ffi_var_set(r, name, name_len, lowcase_buf, value,
+                                   value_len, errbuf, errlen)
+
+    -- ngx.log(ngx.WARN, "rc = ", rc)
+
+    if rc == 0 then -- NGX_OK
+        return
+    end
+
+    if rc == -1 then  -- NGX_ERROR
+        error(ffi_str(errbuf, errlen[0]), 2)
+    end
+end
+
+
+do
+    local mt = new_tab(0, 2)
+    mt.__index = var_get
+    mt.__newindex = var_set
+
+    setmetatable(ngx.var, mt)
+end
+
+
+return {
+    version = base.version
+}

deps/src/lua-resty-core/lib/resty/core/worker.lua

@@ -0,0 +1,77 @@
+-- Copyright (C) Yichun Zhang (agentzh)
+
+
+local ffi = require "ffi"
+local base = require "resty.core.base"
+
+
+local C = ffi.C
+local new_tab = base.new_tab
+local subsystem = ngx.config.subsystem
+
+
+local ngx_lua_ffi_worker_id
+local ngx_lua_ffi_worker_pid
+local ngx_lua_ffi_worker_count
+local ngx_lua_ffi_worker_exiting
+
+
+ngx.worker = new_tab(0, 4)
+
+
+if subsystem == "http" then
+    ffi.cdef[[
+    int ngx_http_lua_ffi_worker_id(void);
+    int ngx_http_lua_ffi_worker_pid(void);
+    int ngx_http_lua_ffi_worker_count(void);
+    int ngx_http_lua_ffi_worker_exiting(void);
+    ]]
+
+    ngx_lua_ffi_worker_id = C.ngx_http_lua_ffi_worker_id
+    ngx_lua_ffi_worker_pid = C.ngx_http_lua_ffi_worker_pid
+    ngx_lua_ffi_worker_count = C.ngx_http_lua_ffi_worker_count
+    ngx_lua_ffi_worker_exiting = C.ngx_http_lua_ffi_worker_exiting
+
+elseif subsystem == "stream" then
+    ffi.cdef[[
+    int ngx_stream_lua_ffi_worker_id(void);
+    int ngx_stream_lua_ffi_worker_pid(void);
+    int ngx_stream_lua_ffi_worker_count(void);
+    int ngx_stream_lua_ffi_worker_exiting(void);
+    ]]
+
+    ngx_lua_ffi_worker_id = C.ngx_stream_lua_ffi_worker_id
+    ngx_lua_ffi_worker_pid = C.ngx_stream_lua_ffi_worker_pid
+    ngx_lua_ffi_worker_count = C.ngx_stream_lua_ffi_worker_count
+    ngx_lua_ffi_worker_exiting = C.ngx_stream_lua_ffi_worker_exiting
+end
+
+
+function ngx.worker.exiting()
+    return ngx_lua_ffi_worker_exiting() ~= 0
+end
+
+
+function ngx.worker.pid()
+    return ngx_lua_ffi_worker_pid()
+end
+
+
+function ngx.worker.id()
+    local id = ngx_lua_ffi_worker_id()
+    if id < 0 then
+        return nil
+    end
+
+    return id
+end
+
+
+function ngx.worker.count()
+    return ngx_lua_ffi_worker_count()
+end
+
+
+return {
+    _VERSION = base.version
+}