fix(ssl): inherit upstream ssl ctx from main request in subrequests

[tzssangglass]

ngx_http_lua_kong_set_upstream_ssl is invoked with the request that initiates the upstream connection. For requests issued via ngx.location.capture, this is the subrequest, whose module ctx is not initialized even when the main request has configured upstream SSL via resty.kong.tls.set_upstream_cert_and_key and friends.

Fall back to r->main's ctx when the current (sub)request has none, so SSL overrides set on the main request propagate to subrequests' upstream handshakes.

Fix: FTI-7709

[Copilot]

Pull request overview

This PR fixes upstream TLS override behavior for subrequests created via ngx.location.capture by allowing ngx_http_lua_kong_set_upstream_ssl to reuse the main request’s ngx_http_lua_kong_module context when the subrequest has none, ensuring upstream client cert/key overrides propagate to subrequest handshakes.

Changes:

• Update upstream-SSL hook to fall back to r->main module ctx when r has no ctx (subrequest case).
• Add a regression test that sets upstream cert/key in the main request and verifies the subrequest handshake presents the expected client certificate.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
src/ngx_http_lua_kong_ssl.c	Falls back to the main request’s module ctx so upstream SSL overrides apply to subrequests.
t/002-upstream-tls.t	Adds a test validating main-request upstream cert/key settings are inherited by ngx.location.capture subrequests.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.