WolfSSL
/
wolfssl-nginx
mirror of https://github.com/wolfSSL/wolfssl-nginx.git
1
0
Fork 0
Code Issues Releases Wiki Activity

Working with newest and patched wolfSSL

pull/3/head
Sean Parkinson 2018-02-09 11:49:19 +10:00
parent 795e3c9f68
commit 259a5c8218
26 changed files with 2573 additions and 133 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
README.md
View File

@ -6,8 +6,12 @@ wolfSSL is supported in Nginx. There are minor changes to the Nginx code base
and recompilation is required.
The tested versions:
- wolfSSL 3.11
- wolfSSL 3.14
- Nginx 1.13.8
- Nginx 1.13.2
- Nginx 1.13.0
- Nginx 1.12.2
- Nginx 1.12.1
- Nginx 1.12.0
- Nginx 1.11.13
- Nginx 1.11.10

67
conf/ca-cert-ecc.pem
View File

@ -2,55 +2,52 @@ Certificate:
Data:
Version: 3 (0x2)
Serial Number:
ef:46:c7:a4:9b:bb:60:d3
97:b4:bd:16:78:f8:47:f2
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Issuer: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Validity
Not Before: Aug 11 20:07:38 2016 GMT
Not After : May 8 20:07:38 2019 GMT
Subject: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Not Before: Oct 20 18:19:06 2017 GMT
Not After : Oct 15 18:19:06 2037 GMT
Subject: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
Public-Key: (256 bit)
pub:
04:bb:33:ac:4c:27:50:4a:c6:4a:a5:04:c3:3c:de:
9f:36:db:72:2d:ce:94:ea:2b:fa:cb:20:09:39:2c:
16:e8:61:02:e9:af:4d:d3:02:93:9a:31:5b:97:92:
21:7f:f0:cf:18:da:91:11:02:34:86:e8:20:58:33:
0b:80:34:89:d8
04:02:d3:d9:6e:d6:01:8e:45:c8:b9:90:31:e5:c0:
4c:e3:9e:ad:29:38:98:ba:10:d6:e9:09:2a:80:a9:
2e:17:2a:b9:8a:bf:33:83:46:e3:95:0b:e4:77:40:
b5:3b:43:45:33:0f:61:53:7c:37:44:c1:cb:fc:80:
ca:e8:43:ea:a7
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Subject Key Identifier:
5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30
56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21
X509v3 Authority Key Identifier:
keyid:5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30
DirName:/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
serial:EF:46:C7:A4:9B:BB:60:D3
keyid:56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21
X509v3 Basic Constraints:
X509v3 Basic Constraints: critical
CA:TRUE
X509v3 Key Usage: critical
Digital Signature, Certificate Sign, CRL Sign
Signature Algorithm: ecdsa-with-SHA256
30:46:02:21:00:f1:d0:a6:3e:83:33:24:d1:7a:05:5f:1e:0e:
bd:7d:6b:33:e9:f2:86:f3:f3:3d:a9:ef:6a:87:31:b3:b7:7e:
50:02:21:00:f0:60:dd:ce:a2:db:56:ec:d9:f4:e4:e3:25:d4:
b0:c9:25:7d:ca:7a:5d:ba:c4:b2:f6:7d:04:c7:bd:62:c9:20
30:45:02:20:32:26:81:e4:15:ec:e3:aa:d3:e5:b8:2a:ca:a3:
06:a7:04:97:d8:43:7f:d4:94:47:f8:18:0d:93:52:23:8b:08:
02:21:00:e1:9e:34:d0:92:ee:56:0d:23:38:4a:20:bc:cf:11:
c3:33:77:96:81:56:2b:ca:c4:d5:c6:65:5d:36:73:2f:ba
-----BEGIN CERTIFICATE-----
MIIDEDCCArWgAwIBAgIJAO9Gx6Sbu2DTMAoGCCqGSM49BAMCMIGPMQswCQYDVQQG
MIICijCCAjCgAwIBAgIJAJe0vRZ4+EfyMAoGCCqGSM49BAMCMIGXMQswCQYDVQQG
EwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEQMA4G
A1UECgwHRWxpcHRpYzEMMAoGA1UECwwDRUNDMRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMTYwODEx
MjAwNzM4WhcNMTkwNTA4MjAwNzM4WjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB0VsaXB0aWMx
DDAKBgNVBAsMA0VDQzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZI
hvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEuzOsTCdQSsZKpQTDPN6fNttyLc6U6iv6yyAJOSwW6GEC6a9N0wKTmjFbl5Ih
f/DPGNqREQI0huggWDMLgDSJ2KOB9zCB9DAdBgNVHQ4EFgQUXV0m76x+NvmbdhUr
SiUCI++yiTAwgcQGA1UdIwSBvDCBuYAUXV0m76x+NvmbdhUrSiUCI++yiTChgZWk
gZIwgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH
DAdTZWF0dGxlMRAwDgYDVQQKDAdFbGlwdGljMQwwCgYDVQQLDANFQ0MxGDAWBgNV
BAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3Ns
LmNvbYIJAO9Gx6Sbu2DTMAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIh
APHQpj6DMyTRegVfHg69fWsz6fKG8/M9qe9qhzGzt35QAiEA8GDdzqLbVuzZ9OTj
JdSwySV9ynpdusSy9n0Ex71iySA=
A1UECgwHd29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGDAWBgNVBAMMD3d3
dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTAe
Fw0xNzEwMjAxODE5MDZaFw0zNzEwMTUxODE5MDZaMIGXMQswCQYDVQQGEwJVUzET
MBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEQMA4GA1UECgwH
d29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGDAWBgNVBAMMD3d3dy53b2xm
c3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqG
SM49AgEGCCqGSM49AwEHA0IABALT2W7WAY5FyLmQMeXATOOerSk4mLoQ1ukJKoCp
LhcquYq/M4NG45UL5HdAtTtDRTMPYVN8N0TBy/yAyuhD6qejYzBhMB0GA1UdDgQW
BBRWjprD8ELeGLlFVW75k8/qw/OlITAfBgNVHSMEGDAWgBRWjprD8ELeGLlFVW75
k8/qw/OlITAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAKBggqhkjO
PQQDAgNIADBFAiAyJoHkFezjqtPluCrKowanBJfYQ3/UlEf4GA2TUiOLCAIhAOGe
NNCS7lYNIzhKILzPEcMzd5aBVivKxNXGZV02cy+6
-----END CERTIFICATE-----

68
conf/cert-ecc.pem
View File

@ -1,13 +1,12 @@
Certificate:
Data:
Version: 3 (0x2)
Serial Number:
ef:46:c7:a4:9b:bb:60:d3
Serial Number: 4096 (0x1000)
Signature Algorithm: ecdsa-with-SHA256
Issuer: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Issuer: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Validity
Not Before: Aug 11 20:07:38 2016 GMT
Not After : May 8 20:07:38 2019 GMT
Not Before: Oct 20 18:19:06 2017 GMT
Not After : Oct 18 18:19:06 2027 GMT
Subject: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com
Subject Public Key Info:
Public Key Algorithm: id-ecPublicKey
@ -21,36 +20,43 @@ Certificate:
ASN1 OID: prime256v1
NIST CURVE: P-256
X509v3 extensions:
X509v3 Basic Constraints:
CA:FALSE
Netscape Cert Type:
SSL Server
X509v3 Subject Key Identifier:
5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30
X509v3 Authority Key Identifier:
keyid:5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30
DirName:/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
serial:EF:46:C7:A4:9B:BB:60:D3
keyid:56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21
DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
serial:97:B4:BD:16:78:F8:47:F2
X509v3 Basic Constraints:
CA:TRUE
X509v3 Key Usage: critical
Digital Signature, Key Encipherment, Key Agreement
X509v3 Extended Key Usage:
TLS Web Server Authentication
Signature Algorithm: ecdsa-with-SHA256
30:46:02:21:00:f1:d0:a6:3e:83:33:24:d1:7a:05:5f:1e:0e:
bd:7d:6b:33:e9:f2:86:f3:f3:3d:a9:ef:6a:87:31:b3:b7:7e:
50:02:21:00:f0:60:dd:ce:a2:db:56:ec:d9:f4:e4:e3:25:d4:
b0:c9:25:7d:ca:7a:5d:ba:c4:b2:f6:7d:04:c7:bd:62:c9:20
30:46:02:21:00:be:b8:58:f0:e4:15:01:1f:df:70:54:73:4a:
6c:40:1f:77:a8:b4:eb:52:1e:bf:f5:0d:b1:33:ca:6a:c4:76:
b9:02:21:00:97:08:de:2c:28:c1:45:71:b6:2c:54:87:98:63:
76:a8:21:34:90:a8:f7:9e:3f:fc:02:b0:e7:d3:09:31:27:e4
-----BEGIN CERTIFICATE-----
MIIDEDCCArWgAwIBAgIJAO9Gx6Sbu2DTMAoGCCqGSM49BAMCMIGPMQswCQYDVQQG
EwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEQMA4G
A1UECgwHRWxpcHRpYzEMMAoGA1UECwwDRUNDMRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMTYwODEx
MjAwNzM4WhcNMTkwNTA4MjAwNzM4WjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB0VsaXB0aWMx
DDAKBgNVBAsMA0VDQzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZI
hvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD
QgAEuzOsTCdQSsZKpQTDPN6fNttyLc6U6iv6yyAJOSwW6GEC6a9N0wKTmjFbl5Ih
f/DPGNqREQI0huggWDMLgDSJ2KOB9zCB9DAdBgNVHQ4EFgQUXV0m76x+NvmbdhUr
SiUCI++yiTAwgcQGA1UdIwSBvDCBuYAUXV0m76x+NvmbdhUrSiUCI++yiTChgZWk
gZIwgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH
DAdTZWF0dGxlMRAwDgYDVQQKDAdFbGlwdGljMQwwCgYDVQQLDANFQ0MxGDAWBgNV
BAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3Ns
LmNvbYIJAO9Gx6Sbu2DTMAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIh
APHQpj6DMyTRegVfHg69fWsz6fKG8/M9qe9qhzGzt35QAiEA8GDdzqLbVuzZ9OTj
JdSwySV9ynpdusSy9n0Ex71iySA=
MIIDUDCCAvWgAwIBAgICEAAwCgYIKoZIzj0EAwIwgZcxCzAJBgNVBAYTAlVTMRMw
EQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3
b2xmU1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZz
c2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTE3MTAy
MDE4MTkwNloXDTI3MTAxODE4MTkwNlowgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQI
DApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAdFbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijggE1MIIBMTAJBgNVHRMEAjAAMBEGCWCGSAGG
+EIBAQQEAwIGQDAdBgNVHQ4EFgQUXV0m76x+NvmbdhUrSiUCI++yiTAwgcwGA1Ud
IwSBxDCBwYAUVo6aw/BC3hi5RVVu+ZPP6sPzpSGhgZ2kgZowgZcxCzAJBgNVBAYT
AlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYD
VQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3
LndvbGZzc2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tggkA
l7S9Fnj4R/IwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAoG
CCqGSM49BAMCA0kAMEYCIQC+uFjw5BUBH99wVHNKbEAfd6i061Iev/UNsTPKasR2
uQIhAJcI3iwowUVxtixUh5hjdqghNJCo954//AKw59MJMSfk
-----END CERTIFICATE-----

19
conf/nginx.conf
View File

@ -99,25 +99,6 @@ http {
index index.html;
}
}
# Using TLS v1.3
server {
listen 11447 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Session ticket
server {

611
conf/nginx_tls13.conf 100644
View File

@ -0,0 +1,611 @@
worker_processes 1;
events {
}
http {
include mime.types;
default_type application/octet-stream;
sendfile on;
keepalive_timeout 65;
ssl_session_tickets off;
# HTTPS server
# Using DH parameters
server {
listen 11443 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Verify client
server {
listen 11444 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_client_certificate client-cert.pem;
ssl_verify_client on;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# P384 curve with ECDHE
server {
listen 11445 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Default curve with ECDHE and ECDSA
server {
listen 11446 ssl;
server_name localhost;
ssl_certificate cert-ecc.pem;
ssl_certificate_key cert-ecc-p8.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Using TLS v1.3
server {
listen 11447 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Session ticket
server {
listen 11450 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_ticket_key ticket_keys;
ssl_session_tickets on;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Session cache off
server {
listen 11455 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache off;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Session cache none
server {
listen 11456 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache none;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Session cache builtin
server {
listen 11457 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache builtin:100;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Proxy to wolfSSL server
upstream backend {
server 127.0.0.1:12443;
}
server {
listen 127.0.0.1:12443 ssl;
server_name www.wolfssl.com;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root wolfssl;
index index.html;
}
}
upstream backend_ecdhe_rsa {
server 127.0.0.1:12444;
}
server {
listen 127.0.0.1:12444 ssl;
server_name www.wolfssl.com;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root wolfssl;
index index.html;
}
}
upstream backend_ecdhe_ecdsa {
server 127.0.0.1:12445;
}
server {
listen 127.0.0.1:12445 ssl;
server_name www.wolfssl.com;
ssl_certificate cert-ecc.pem;
ssl_certificate_key cert-ecc-priv.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root wolfssl;
index index.html;
}
}
upstream backend_crl_rev {
server 127.0.0.1:12446;
}
server {
listen 127.0.0.1:12446 ssl;
server_name www.wolfssl.com;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root wolfssl;
index index.html;
}
}
upstream backend_chain {
server 127.0.0.1:12447;
}
server {
listen 127.0.0.1:12447 ssl;
server_name ecc-3-leaf;
ssl_certificate ecc-3-caleaf.crt;
ssl_certificate_key ecc-3-leaf.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root wolfssl;
index index.html;
}
}
upstream backend_bad_chain {
server 127.0.0.1:12448;
}
server {
listen 127.0.0.1:12448 ssl;
server_name ecc-3-leaf;
ssl_certificate ecc-3-leaf.crt;
ssl_certificate_key ecc-3-leaf.key;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
location / {
root wolfssl;
index index.html;
}
}
# Proxy using DHE cipher suites and CRL
server {
listen 11460 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://backend;
proxy_ssl_name www.wolfssl.com;
proxy_ssl_server_name on;
proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
proxy_ssl_trusted_certificate ca-cert.pem;
proxy_ssl_certificate client-cert.pem;
proxy_ssl_certificate_key client-key.pem;
proxy_ssl_verify on;
proxy_ssl_crl crl.pem;
}
}
# Proxy using ECDHE cipher suites and CRL
server {
listen 11461 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://backend_ecdhe_rsa;
proxy_ssl_name www.wolfssl.com;
proxy_ssl_server_name on;
proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
proxy_ssl_trusted_certificate ca-cert.pem;
proxy_ssl_certificate client-cert.pem;
proxy_ssl_certificate_key client-key.pem;
proxy_ssl_verify on;
proxy_ssl_crl crl.pem;
}
}
# Proxy using ECDHE and ECDSA cipher suites
server {
listen 11462 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://backend_ecdhe_ecdsa;
proxy_ssl_name www.wolfssl.com;
proxy_ssl_server_name on;
proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
proxy_ssl_trusted_certificate ca-cert-ecc.pem;
proxy_ssl_certificate client-cert.pem;
proxy_ssl_certificate_key client-key.pem;
proxy_ssl_verify on;
proxy_ssl_session_reuse on;
}
}
# Proxy using complete chain
server {
listen 11463 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://backend_chain;
proxy_ssl_name ecc-3-leaf;
proxy_ssl_server_name on;
proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
proxy_ssl_trusted_certificate ecc-3-root.crt;
proxy_ssl_certificate client-cert.pem;
proxy_ssl_certificate_key client-key.pem;
proxy_ssl_verify on;
proxy_ssl_session_reuse on;
}
}
# Proxy using incomplete chain
server {
listen 11464 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://backend_bad_chain;
proxy_ssl_name ecc-3-leaf;
proxy_ssl_server_name on;
proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
proxy_ssl_trusted_certificate ecc-3-root.crt;
proxy_ssl_certificate client-cert.pem;
proxy_ssl_certificate_key client-key.pem;
proxy_ssl_verify on;
proxy_ssl_session_reuse on;
}
}
# Proxy using revoked CRL
server {
listen 11465 ssl;
server_name localhost;
ssl_certificate cert.pem;
ssl_certificate_key cert.key;
ssl_dhparam dhparams.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
proxy_pass https://backend_crl_rev;
proxy_ssl_name www.wolfssl.com;
proxy_ssl_server_name on;
proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384;
proxy_ssl_trusted_certificate ca-cert.pem;
proxy_ssl_certificate client-cert.pem;
proxy_ssl_certificate_key client-key.pem;
proxy_ssl_verify on;
proxy_ssl_crl crl-revoked.pem;
proxy_ssl_session_reuse on;
}
}
# OCSP Stapling
# Valid server certificate - using OCSP responder
server {
listen 11470 ssl;
server_name localhost;
ssl_certificate ocsp-good-cert.pem;
ssl_certificate_key ocsp-good-key.pem;
ssl_stapling on;
ssl_stapling_responder http://127.0.0.1:22221;
ssl_stapling_verify on;
ssl_trusted_certificate ocsp-root-resp-cert.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Revoked server certificate - using OCSP responder
server {
listen 11471 ssl;
server_name localhost;
ssl_certificate ocsp-bad-cert.pem;
ssl_certificate_key ocsp-bad-key.pem;
ssl_stapling on;
ssl_stapling_responder http://127.0.0.1:22221;
ssl_trusted_certificate ocsp-root-resp-cert.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Valid server certificate in fixed OCSP response
server {
listen 11472 ssl;
server_name localhost;
ssl_certificate ocsp-good-cert.pem;
ssl_certificate_key ocsp-good-key.pem;
ssl_stapling on;
ssl_stapling_file ocsp-good-status.der;
ssl_trusted_certificate ocsp-root-resp-cert.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# Revoked server certificate in fixed OCSP response
server {
listen 11473 ssl;
server_name localhost;
ssl_certificate ocsp-bad-cert.pem;
ssl_certificate_key ocsp-bad-key.pem;
ssl_stapling on;
ssl_stapling_file ocsp-bad-status.der;
ssl_trusted_certificate ocsp-root-resp-cert.pem;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
# No CA to check responder certificate - using OCSP responder
server {
listen 11474 ssl;
server_name localhost;
ssl_certificate ocsp-good-cert.pem;
ssl_certificate_key ocsp-good-key.pem;
ssl_stapling on;
ssl_stapling_responder http://127.0.0.1:22221;
ssl_stapling_verify on;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;
ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA;
ssl_prefer_server_ciphers on;
location / {
root html;
index index.html;
}
}
}

4
nginx-1.10.3-wolfssl-debug.patch
View File

@ -1,6 +1,6 @@
diff -ur nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:37:30.867368905 +1000
+++ nginx-1.10.3-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:02.561501608 +1000
--- nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:21:43.593980737 +1000
+++ nginx-1.10.3-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 09:22:03.135202985 +1000
@@ -128,6 +128,11 @@
#endif

69
nginx-1.10.3-wolfssl.patch
View File

@ -57,7 +57,7 @@ diff -ur nginx-1.10.3/auto/options nginx-1.10.3-wolfssl/auto/options
diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.10.3/src/event/ngx_event_openssl.c 2017-02-01 01:01:11.000000000 +1000
+++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:37:30.867368905 +1000
+++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:21:43.593980737 +1000
@@ -55,7 +55,7 @@
HMAC_CTX *hctx, int enc);
#endif
@ -101,7 +101,54 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve
ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
@@ -2971,6 +2980,11 @@
@@ -1019,6 +1028,38 @@
{
#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef OPENSSL_NO_ECDH
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
+
+ /*
+ * OpenSSL 1.0.2+ allows configuring a curve list instead of a single
+ * curve previously supported. By default an internal list is used,
+ * with prime256v1 being preferred by server in OpenSSL 1.0.2b+
+ * and X25519 in OpenSSL 1.1.0+.
+ *
+ * By default a curve preferred by the client will be used for
+ * key exchange. The SSL_OP_CIPHER_SERVER_PREFERENCE option can
+ * be used to prefer server curves instead, similar to what it
+ * does for ciphers.
+ */
+
+ SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE);
+
+#if SSL_CTRL_SET_ECDH_AUTO
+ /* not needed in OpenSSL 1.1.0+ */
+ SSL_CTX_set_ecdh_auto(ssl->ctx, 1);
+#endif
+
+ if (ngx_strcmp(name->data, "auto") == 0) {
+ return NGX_OK;
+ }
+
+ if (SSL_CTX_set1_curves_list(ssl->ctx, (char *) name->data) == 0) {
+ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0,
+ "SSL_CTX_set1_curves_list(\"%s\") failed", name->data);
+ return NGX_ERROR;
+ }
+
+#else
int nid;
EC_KEY *ecdh;
@@ -1050,6 +1091,7 @@
EC_KEY_free(ecdh);
#endif
#endif
+#endif
return NGX_OK;
}
@@ -2971,6 +3013,11 @@
ngx_ssl_cleanup_ctx(void *data)
{
ngx_ssl_t *ssl = data;
@ -113,7 +160,7 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve
SSL_CTX_free(ssl->ctx);
}
@@ -2986,7 +3000,7 @@
@@ -2986,7 +3033,7 @@
return NGX_ERROR;
}
@ -122,7 +169,7 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve
/* X509_check_host() is only available in OpenSSL 1.0.2+ */
@@ -3103,7 +3117,7 @@
@@ -3103,7 +3150,7 @@
}
@ -133,8 +180,18 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve
ngx_ssl_check_name(ngx_str_t *name, ASN1_STRING *pattern)
diff -ur nginx-1.10.3/src/event/ngx_event_openssl.h nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.10.3/src/event/ngx_event_openssl.h 2017-02-01 01:01:11.000000000 +1000
+++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 15:37:15.307255249 +1000
@@ -142,6 +142,7 @@
+++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:09:01.157341959 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -142,6 +145,7 @@
ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data);
ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);

4
nginx-1.11.10-wolfssl-debug.patch
View File

@ -1,6 +1,6 @@
diff -ur nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c nginx-1.11.10-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:53:51.151297965 +1000
+++ nginx-1.11.10-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:18.269591752 +1000
--- nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:26:50.942730388 +1000
+++ nginx-1.11.10-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 14:27:40.675012575 +1000
@@ -144,6 +144,11 @@
#endif

45
nginx-1.11.10-wolfssl.patch
View File

@ -56,7 +56,7 @@ diff -ur nginx-1.11.10/auto/options nginx-1.11.10-wolfssl/auto/options
diff -ur nginx-1.11.10/src/event/ngx_event_openssl.c nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.11.10/src/event/ngx_event_openssl.c 2017-02-15 01:36:05.000000000 +1000
+++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:53:51.151297965 +1000
+++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:26:50.942730388 +1000
@@ -340,6 +340,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
@ -83,10 +83,49 @@ diff -ur nginx-1.11.10/src/event/ngx_event_openssl.c nginx-1.11.10-wolfssl/src/e
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1082,7 +1094,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3050,7 +3062,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3094,7 +3107,8 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.11.10/src/event/ngx_event_openssl.h nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.11.10/src/event/ngx_event_openssl.h 2017-02-15 01:36:05.000000000 +1000
+++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 14:54:11.115369454 +1000
@@ -147,6 +147,7 @@
+++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:08:26.869420014 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -147,6 +150,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);

4
nginx-1.11.13-wolfssl-debug.patch
View File

@ -1,6 +1,6 @@
diff -ur nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c nginx-1.11.13-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:07:53.569430271 +1000
+++ nginx-1.11.13-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:20.801606211 +1000
--- nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:07:36.997535505 +1000
+++ nginx-1.11.13-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 09:07:52.965498263 +1000
@@ -144,6 +144,11 @@
#endif

25
nginx-1.11.13-wolfssl.patch
View File

@ -64,7 +64,7 @@ diff -ur nginx-1.11.13/auto/options nginx-1.11.13-wolfssl/auto/options
diff -ur nginx-1.11.13/src/event/ngx_event_openssl.c nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.11.13/src/event/ngx_event_openssl.c 2017-04-05 01:01:57.000000000 +1000
+++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:07:53.569430271 +1000
+++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:07:36.997535505 +1000
@@ -340,6 +340,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
@ -91,10 +91,29 @@ diff -ur nginx-1.11.13/src/event/ngx_event_openssl.c nginx-1.11.13-wolfssl/src/e
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1082,7 +1094,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
diff -ur nginx-1.11.13/src/event/ngx_event_openssl.h nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.11.13/src/event/ngx_event_openssl.h 2017-04-05 01:01:57.000000000 +1000
+++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 15:08:11.385467468 +1000
@@ -147,6 +147,7 @@
+++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:07:12.437593298 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -147,6 +150,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);

4
nginx-1.11.7-wolfssl-debug.patch
View File

@ -1,6 +1,6 @@
diff -ur nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:47:08.313886491 +1000
+++ nginx-1.11.7-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:23.309620512 +1000
--- nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:27:14.826866032 +1000
+++ nginx-1.11.7-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 14:28:01.823132284 +1000
@@ -134,6 +134,11 @@
#endif

45
nginx-1.11.7-wolfssl.patch
View File

@ -56,7 +56,7 @@ diff -ur nginx-1.11.7/auto/options nginx-1.11.7-wolfssl/auto/options
diff -ur nginx-1.11.7/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.11.7/src/event/ngx_event_openssl.c 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:47:08.313886491 +1000
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:27:14.826866032 +1000
@@ -330,6 +330,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
@ -83,10 +83,49 @@ diff -ur nginx-1.11.7/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl/src/eve
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1072,7 +1084,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3019,7 +3031,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, 16, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3054,7 +3067,8 @@
ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
(i == 0) ? " (default)" : "");
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, 16, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.11.7/src/event/ngx_event_openssl.h nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.11.7/src/event/ngx_event_openssl.h 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 14:49:57.150469616 +1000
@@ -146,6 +146,7 @@
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:01:17.610518828 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -146,6 +149,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);

4
nginx-1.12.0-wolfssl-debug.patch
View File

@ -1,6 +1,6 @@
diff -ur nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c nginx-1.12.0-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:05:43.741185370 +1000
+++ nginx-1.12.0-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:26.645639503 +1000
--- nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:04:48.653303612 +1000
+++ nginx-1.12.0-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 11:05:10.313347727 +1000
@@ -144,6 +144,11 @@
#endif

45
nginx-1.12.0-wolfssl.patch
View File

@ -64,7 +64,7 @@ diff -ur nginx-1.12.0/auto/options nginx-1.12.0-wolfssl/auto/options
diff -ur nginx-1.12.0/src/event/ngx_event_openssl.c nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.12.0/src/event/ngx_event_openssl.c 2017-04-13 00:46:01.000000000 +1000
+++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:05:43.741185370 +1000
+++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:04:48.653303612 +1000
@@ -340,6 +340,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
@ -91,10 +91,49 @@ diff -ur nginx-1.12.0/src/event/ngx_event_openssl.c nginx-1.12.0-wolfssl/src/eve
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1082,7 +1094,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3050,7 +3062,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3094,7 +3107,8 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.12.0/src/event/ngx_event_openssl.h nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.12.0/src/event/ngx_event_openssl.h 2017-04-13 00:46:01.000000000 +1000
+++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 15:06:02.777218149 +1000
@@ -147,6 +147,7 @@
+++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 08:50:02.145284612 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -147,6 +150,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);

238
nginx-1.12.1-wolfssl-debug.patch 100644
View File

@ -0,0 +1,238 @@
diff -ur nginx-1.12.1-wolfssl/auto/lib/openssl/conf nginx-1.12.1-wolfssl-debug/auto/lib/openssl/conf
--- nginx-1.12.1-wolfssl/auto/lib/openssl/conf 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/auto/lib/openssl/conf 2018-02-02 11:12:46.602768290 +1000
@@ -61,33 +61,8 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
-
- if [ $WOLFSSL != NONE ]; then
- ngx_feature="wolfSSL library in $WOLFSSL"
- ngx_feature_path="$WOLFSSL/include/wolfssl"
-
- if [ $NGX_RPATH = YES ]; then
- ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
- else
- ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
- fi
-
- CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
- CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
- fi
-
. auto/feature
- if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
-cat << END
-
-$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
-SSL modules require the wolfSSL library.
-
-END
- exit 1
- fi
-
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.12.1-wolfssl/auto/options nginx-1.12.1-wolfssl-debug/auto/options
--- nginx-1.12.1-wolfssl/auto/options 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/auto/options 2018-02-02 11:12:46.602768290 +1000
@@ -143,7 +143,6 @@
USE_OPENSSL=NO
OPENSSL=NONE
-WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -346,7 +345,6 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
- --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -565,7 +563,6 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
- --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
diff -ur nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 11:14:10.811101939 +1000
@@ -144,6 +144,11 @@
#endif
+#ifdef WOLFSSL_NGINX
+ /* Turn on internal wolfssl debugging to stdout */
+ wolfSSL_Debugging_ON();
+#endif
+
#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef SSL_OP_NO_COMPRESSION
{
@@ -340,10 +345,6 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
-#ifdef WOLFSSL_NGINX
- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
-#endif
-
return NGX_OK;
}
@@ -652,14 +653,6 @@
ngx_int_t
-ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
-{
- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
-
- return NGX_OK;
-}
-
-ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1094,7 +1087,7 @@
* maximum interoperability.
*/
-#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
+#ifdef SSL_CTRL_SET_CURVES_LIST
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3062,8 +3055,7 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3107,8 +3099,7 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.h
--- nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.h 2018-02-02 11:12:46.606768306 +1000
@@ -12,9 +12,6 @@
#include <ngx_config.h>
#include <ngx_core.h>
-#ifdef WOLFSSL_NGINX
-#include <wolfssl/options.h>
-#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -150,7 +147,6 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
-ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl_stapling.c
--- nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:12:46.606768306 +1000
@@ -313,9 +313,7 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#ifdef WOLFSSL_NGINX
- issuer = X509_dup(issuer);
-#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
+#if OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:12:46.610768321 +1000
@@ -4371,8 +4371,6 @@
return NGX_ERROR;
}
- ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
-
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:12:46.610768321 +1000
@@ -14,11 +14,7 @@
ngx_pool_t *pool, ngx_str_t *s);
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c nginx-1.12.1-wolfssl-debug/src/mail/ngx_mail_ssl_module.c
--- nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:12:46.614768337 +1000
@@ -10,11 +10,7 @@
#include <ngx_mail.h>
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_proxy_module.c
--- nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:12:46.618768352 +1000
@@ -2001,8 +2001,6 @@
return NGX_ERROR;
}
- ngx_ssl_set_verify_on(cf, pscf->ssl);
-
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_ssl_module.c
--- nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:14:00.503060273 +1000
+++ nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:12:46.618768352 +1000
@@ -14,11 +14,7 @@
ngx_pool_t *pool, ngx_str_t *s);
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

226
nginx-1.12.1-wolfssl.patch 100644
View File

@ -0,0 +1,226 @@
diff -ur nginx-1.12.1/auto/lib/openssl/conf nginx-1.12.1-wolfssl/auto/lib/openssl/conf
--- nginx-1.12.1/auto/lib/openssl/conf 2017-07-11 23:24:06.000000000 +1000
+++ nginx-1.12.1-wolfssl/auto/lib/openssl/conf 2018-02-02 11:14:00.503060273 +1000
@@ -61,8 +61,33 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+
+ if [ $WOLFSSL != NONE ]; then
+ ngx_feature="wolfSSL library in $WOLFSSL"
+ ngx_feature_path="$WOLFSSL/include/wolfssl"
+
+ if [ $NGX_RPATH = YES ]; then
+ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ else
+ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ fi
+
+ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
+ CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
+ fi
+
. auto/feature
+ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
+cat << END
+
+$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
+SSL modules require the wolfSSL library.
+
+END
+ exit 1
+ fi
+
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.12.1/auto/options nginx-1.12.1-wolfssl/auto/options
--- nginx-1.12.1/auto/options 2017-07-11 23:24:06.000000000 +1000
+++ nginx-1.12.1-wolfssl/auto/options 2018-02-02 11:14:00.503060273 +1000
@@ -143,6 +143,7 @@
USE_OPENSSL=NO
OPENSSL=NONE
+WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -345,6 +346,7 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
+ --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -563,6 +565,7 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
+ --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
diff -ur nginx-1.12.1/src/event/ngx_event_openssl.c nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.12.1/src/event/ngx_event_openssl.c 2017-07-11 23:24:07.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:14:00.503060273 +1000
@@ -340,6 +340,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
+#ifdef WOLFSSL_NGINX
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
+#endif
+
return NGX_OK;
}
@@ -648,6 +652,14 @@
ngx_int_t
+ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
+{
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
+
+ return NGX_OK;
+}
+
+ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1082,7 +1094,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3050,7 +3062,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3094,7 +3107,8 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.12.1/src/event/ngx_event_openssl.h nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.12.1/src/event/ngx_event_openssl.h 2017-07-11 23:24:07.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:14:00.503060273 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -147,6 +150,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
+ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.12.1/src/event/ngx_event_openssl_stapling.c nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c
--- nginx-1.12.1/src/event/ngx_event_openssl_stapling.c 2017-07-11 23:24:07.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:14:00.503060273 +1000
@@ -313,7 +313,9 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
+#ifdef WOLFSSL_NGINX
+ issuer = X509_dup(issuer);
+#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.12.1/src/http/modules/ngx_http_proxy_module.c nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.12.1/src/http/modules/ngx_http_proxy_module.c 2017-07-11 23:24:08.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:14:00.503060273 +1000
@@ -4371,6 +4371,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
+
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.12.1/src/http/modules/ngx_http_ssl_module.c nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.12.1/src/http/modules/ngx_http_ssl_module.c 2017-07-11 23:24:08.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:14:00.503060273 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.12.1/src/mail/ngx_mail_ssl_module.c nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c
--- nginx-1.12.1/src/mail/ngx_mail_ssl_module.c 2017-07-11 23:24:10.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:14:00.503060273 +1000
@@ -10,7 +10,11 @@
#include <ngx_mail.h>
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.12.1/src/stream/ngx_stream_proxy_module.c nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c
--- nginx-1.12.1/src/stream/ngx_stream_proxy_module.c 2017-07-11 23:24:11.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:14:00.503060273 +1000
@@ -2001,6 +2001,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, pscf->ssl);
+
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.12.1/src/stream/ngx_stream_ssl_module.c nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c
--- nginx-1.12.1/src/stream/ngx_stream_ssl_module.c 2017-07-11 23:24:11.000000000 +1000
+++ nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:14:00.503060273 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

238
nginx-1.12.2-wolfssl-debug.patch 100644
View File

@ -0,0 +1,238 @@
diff -ur nginx-1.12.2-wolfssl/auto/lib/openssl/conf nginx-1.12.2-wolfssl-debug/auto/lib/openssl/conf
--- nginx-1.12.2-wolfssl/auto/lib/openssl/conf 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/auto/lib/openssl/conf 2018-02-02 11:13:06.954847473 +1000
@@ -61,33 +61,8 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
-
- if [ $WOLFSSL != NONE ]; then
- ngx_feature="wolfSSL library in $WOLFSSL"
- ngx_feature_path="$WOLFSSL/include/wolfssl"
-
- if [ $NGX_RPATH = YES ]; then
- ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
- else
- ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
- fi
-
- CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
- CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
- fi
-
. auto/feature
- if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
-cat << END
-
-$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
-SSL modules require the wolfSSL library.
-
-END
- exit 1
- fi
-
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.12.2-wolfssl/auto/options nginx-1.12.2-wolfssl-debug/auto/options
--- nginx-1.12.2-wolfssl/auto/options 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/auto/options 2018-02-02 11:13:06.954847473 +1000
@@ -143,7 +143,6 @@
USE_OPENSSL=NO
OPENSSL=NONE
-WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -346,7 +345,6 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
- --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -565,7 +563,6 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
- --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
diff -ur nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 11:13:47.819009306 +1000
@@ -144,6 +144,11 @@
#endif
+#ifdef WOLFSSL_NGINX
+ /* Turn on internal wolfssl debugging to stdout */
+ wolfSSL_Debugging_ON();
+#endif
+
#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef SSL_OP_NO_COMPRESSION
{
@@ -340,10 +345,6 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
-#ifdef WOLFSSL_NGINX
- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
-#endif
-
return NGX_OK;
}
@@ -652,14 +653,6 @@
ngx_int_t
-ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
-{
- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
-
- return NGX_OK;
-}
-
-ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1094,7 +1087,7 @@
* maximum interoperability.
*/
-#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
+#ifdef SSL_CTRL_SET_CURVES_LIST
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3062,8 +3055,7 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3107,8 +3099,7 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.h
--- nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.h 2018-02-02 11:13:06.958847490 +1000
@@ -12,9 +12,6 @@
#include <ngx_config.h>
#include <ngx_core.h>
-#ifdef WOLFSSL_NGINX
-#include <wolfssl/options.h>
-#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -150,7 +147,6 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
-ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl_stapling.c
--- nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:13:06.958847490 +1000
@@ -313,9 +313,7 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#ifdef WOLFSSL_NGINX
- issuer = X509_dup(issuer);
-#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
+#if OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:13:06.962847505 +1000
@@ -4371,8 +4371,6 @@
return NGX_ERROR;
}
- ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
-
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:13:34.994958124 +1000
+++ nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:13:06.962847505 +1000
@@ -14,11 +14,7 @@
ngx_pool_t *pool, ngx_str_t *s);
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c nginx-1.12.2-wolfssl-debug/src/mail/ngx_mail_ssl_module.c
--- nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:13:34.998958139 +1000
+++ nginx-1.12.2-wolfssl-debug/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:13:06.966847521 +1000
@@ -10,11 +10,7 @@
#include <ngx_mail.h>
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_proxy_module.c
--- nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:13:34.998958139 +1000
+++ nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:13:06.970847536 +1000
@@ -2005,8 +2005,6 @@
return NGX_ERROR;
}
- ngx_ssl_set_verify_on(cf, pscf->ssl);
-
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_ssl_module.c
--- nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:13:34.998958139 +1000
+++ nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:13:06.970847536 +1000
@@ -14,11 +14,7 @@
ngx_pool_t *pool, ngx_str_t *s);
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

226
nginx-1.12.2-wolfssl.patch 100644
View File

@ -0,0 +1,226 @@
diff -ur nginx-1.12.2/auto/lib/openssl/conf nginx-1.12.2-wolfssl/auto/lib/openssl/conf
--- nginx-1.12.2/auto/lib/openssl/conf 2017-10-17 23:16:37.000000000 +1000
+++ nginx-1.12.2-wolfssl/auto/lib/openssl/conf 2018-02-02 11:13:34.994958124 +1000
@@ -61,8 +61,33 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+
+ if [ $WOLFSSL != NONE ]; then
+ ngx_feature="wolfSSL library in $WOLFSSL"
+ ngx_feature_path="$WOLFSSL/include/wolfssl"
+
+ if [ $NGX_RPATH = YES ]; then
+ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ else
+ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ fi
+
+ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
+ CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
+ fi
+
. auto/feature
+ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
+cat << END
+
+$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
+SSL modules require the wolfSSL library.
+
+END
+ exit 1
+ fi
+
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.12.2/auto/options nginx-1.12.2-wolfssl/auto/options
--- nginx-1.12.2/auto/options 2017-10-17 23:16:37.000000000 +1000
+++ nginx-1.12.2-wolfssl/auto/options 2018-02-02 11:13:34.994958124 +1000
@@ -143,6 +143,7 @@
USE_OPENSSL=NO
OPENSSL=NONE
+WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -345,6 +346,7 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
+ --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -563,6 +565,7 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
+ --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
diff -ur nginx-1.12.2/src/event/ngx_event_openssl.c nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.12.2/src/event/ngx_event_openssl.c 2017-10-17 23:16:38.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:13:34.994958124 +1000
@@ -340,6 +340,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
+#ifdef WOLFSSL_NGINX
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
+#endif
+
return NGX_OK;
}
@@ -648,6 +652,14 @@
ngx_int_t
+ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
+{
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
+
+ return NGX_OK;
+}
+
+ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1082,7 +1094,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3050,7 +3062,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3094,7 +3107,8 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.12.2/src/event/ngx_event_openssl.h nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.12.2/src/event/ngx_event_openssl.h 2017-10-17 23:16:38.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:13:34.994958124 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -147,6 +150,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
+ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.12.2/src/event/ngx_event_openssl_stapling.c nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c
--- nginx-1.12.2/src/event/ngx_event_openssl_stapling.c 2017-10-17 23:16:38.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:13:34.994958124 +1000
@@ -313,7 +313,9 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
+#ifdef WOLFSSL_NGINX
+ issuer = X509_dup(issuer);
+#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.12.2/src/http/modules/ngx_http_proxy_module.c nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.12.2/src/http/modules/ngx_http_proxy_module.c 2017-10-17 23:16:38.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:13:34.994958124 +1000
@@ -4371,6 +4371,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
+
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.12.2/src/http/modules/ngx_http_ssl_module.c nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.12.2/src/http/modules/ngx_http_ssl_module.c 2017-10-17 23:16:38.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:13:34.994958124 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.12.2/src/mail/ngx_mail_ssl_module.c nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c
--- nginx-1.12.2/src/mail/ngx_mail_ssl_module.c 2017-10-17 23:16:38.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:13:34.998958139 +1000
@@ -10,7 +10,11 @@
#include <ngx_mail.h>
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.12.2/src/stream/ngx_stream_proxy_module.c nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c
--- nginx-1.12.2/src/stream/ngx_stream_proxy_module.c 2017-10-17 23:16:39.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:13:34.998958139 +1000
@@ -2005,6 +2005,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, pscf->ssl);
+
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.12.2/src/stream/ngx_stream_ssl_module.c nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c
--- nginx-1.12.2/src/stream/ngx_stream_ssl_module.c 2017-10-17 23:16:39.000000000 +1000
+++ nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:13:34.998958139 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

208
nginx-1.13.0-wolfssl-debug.patch 100644
View File

@ -0,0 +1,208 @@
diff -ur nginx-1.13.0-wolfssl/auto/lib/openssl/conf nginx-1.13.0-wolfssl-debug/auto/lib/openssl/conf
--- nginx-1.13.0-wolfssl/auto/lib/openssl/conf 2018-02-01 08:37:32.565863658 +1000
+++ nginx-1.13.0-wolfssl-debug/auto/lib/openssl/conf 2018-02-01 08:36:08.797416011 +1000
@@ -61,33 +61,8 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
-
- if [ $WOLFSSL != NONE ]; then
- ngx_feature="wolfSSL library in $WOLFSSL"
- ngx_feature_path="$WOLFSSL/include/wolfssl"
-
- if [ $NGX_RPATH = YES ]; then
- ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
- else
- ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
- fi
-
- CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
- CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
- fi
-
. auto/feature
- if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
-cat << END
-
-$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
-SSL modules require the wolfSSL library.
-
-END
- exit 1
- fi
-
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.13.0-wolfssl/auto/options nginx-1.13.0-wolfssl-debug/auto/options
--- nginx-1.13.0-wolfssl/auto/options 2018-02-01 08:37:32.565863658 +1000
+++ nginx-1.13.0-wolfssl-debug/auto/options 2018-02-01 08:36:08.797416011 +1000
@@ -143,7 +143,6 @@
USE_OPENSSL=NO
OPENSSL=NONE
-WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -346,7 +345,6 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
- --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -565,7 +563,6 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
- --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
diff -ur nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 08:42:59.243534258 +1000
+++ nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-01 08:41:43.047153153 +1000
@@ -144,6 +144,11 @@
#endif
+#ifdef WOLFSSL_NGINX
+ /* Turn on internal wolfssl debugging to stdout */
+ wolfSSL_Debugging_ON();
+#endif
+
#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef SSL_OP_NO_COMPRESSION
{
@@ -346,10 +351,6 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
-#ifdef WOLFSSL_NGINX
- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
-#endif
-
return NGX_OK;
}
@@ -658,14 +659,6 @@
ngx_int_t
-ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
-{
- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
-
- return NGX_OK;
-}
-
-ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
diff -ur nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.h
--- nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h 2018-02-01 08:42:38.107428966 +1000
+++ nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.h 2018-02-01 08:40:01.334637114 +1000
@@ -57,7 +57,7 @@
#define ngx_ssl_conn_t SSL
-#if (OPENSSL_VERSION_NUMBER < 0x10002000L) && !defined(WOLFSSL_NGINX)
+#if (OPENSSL_VERSION_NUMBER < 0x10002000L)
#define SSL_is_server(s) (s)->server
#endif
@@ -156,7 +156,6 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
-ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl_stapling.c
--- nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-01 08:37:32.569863679 +1000
+++ nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl_stapling.c 2018-02-01 08:36:08.805416054 +1000
@@ -313,9 +313,7 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#ifdef WOLFSSL_NGINX
- issuer = X509_dup(issuer);
-#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
+#if OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-01 08:37:32.569863679 +1000
+++ nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c 2018-02-01 08:36:08.805416054 +1000
@@ -4372,8 +4372,6 @@
return NGX_ERROR;
}
- ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
-
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-01 08:37:32.569863679 +1000
+++ nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c 2018-02-01 08:36:08.809416074 +1000
@@ -14,11 +14,7 @@
ngx_pool_t *pool, ngx_str_t *s);
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c nginx-1.13.0-wolfssl-debug/src/mail/ngx_mail_ssl_module.c
--- nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-01 08:37:32.569863679 +1000
+++ nginx-1.13.0-wolfssl-debug/src/mail/ngx_mail_ssl_module.c 2018-02-01 08:36:08.813416096 +1000
@@ -10,11 +10,7 @@
#include <ngx_mail.h>
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_proxy_module.c
--- nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-01 08:37:32.569863679 +1000
+++ nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_proxy_module.c 2018-02-01 08:36:08.813416096 +1000
@@ -2002,8 +2002,6 @@
return NGX_ERROR;
}
- ngx_ssl_set_verify_on(cf, pscf->ssl);
-
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_ssl_module.c
--- nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-01 08:37:32.569863679 +1000
+++ nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_ssl_module.c 2018-02-01 08:36:08.813416096 +1000
@@ -14,11 +14,7 @@
ngx_pool_t *pool, ngx_str_t *s);
-#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
-#else
-#define NGX_DEFAULT_CIPHERS "ALL"
-#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

216
nginx-1.13.0-wolfssl.patch 100644
View File

@ -0,0 +1,216 @@
diff -ur nginx-1.13.0/auto/lib/openssl/conf nginx-1.13.0-wolfssl/auto/lib/openssl/conf
--- nginx-1.13.0/auto/lib/openssl/conf 2017-04-26 00:18:22.000000000 +1000
+++ nginx-1.13.0-wolfssl/auto/lib/openssl/conf 2018-02-01 08:37:32.565863658 +1000
@@ -61,8 +61,33 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+
+ if [ $WOLFSSL != NONE ]; then
+ ngx_feature="wolfSSL library in $WOLFSSL"
+ ngx_feature_path="$WOLFSSL/include/wolfssl"
+
+ if [ $NGX_RPATH = YES ]; then
+ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ else
+ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ fi
+
+ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
+ CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
+ fi
+
. auto/feature
+ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
+cat << END
+
+$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
+SSL modules require the wolfSSL library.
+
+END
+ exit 1
+ fi
+
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.13.0/auto/options nginx-1.13.0-wolfssl/auto/options
--- nginx-1.13.0/auto/options 2017-04-26 00:18:22.000000000 +1000
+++ nginx-1.13.0-wolfssl/auto/options 2018-02-01 08:37:32.565863658 +1000
@@ -143,6 +143,7 @@
USE_OPENSSL=NO
OPENSSL=NONE
+WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -345,6 +346,7 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
+ --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -563,6 +565,7 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
+ --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
diff -ur nginx-1.13.0/src/event/ngx_event_openssl.c nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.13.0/src/event/ngx_event_openssl.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 08:42:59.243534258 +1000
@@ -346,6 +346,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
+#ifdef WOLFSSL_NGINX
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
+#endif
+
return NGX_OK;
}
@@ -654,6 +658,14 @@
ngx_int_t
+ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
+{
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
+
+ return NGX_OK;
+}
+
+ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1090,7 +1102,8 @@
* maximum interoperability.
*/
-#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST)
+#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) || \
+ defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
diff -ur nginx-1.13.0/src/event/ngx_event_openssl.h nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.13.0/src/event/ngx_event_openssl.h 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h 2018-02-01 08:42:38.107428966 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -54,7 +57,7 @@
#define ngx_ssl_conn_t SSL
-#if (OPENSSL_VERSION_NUMBER < 0x10002000L)
+#if (OPENSSL_VERSION_NUMBER < 0x10002000L) && !defined(WOLFSSL_NGINX)
#define SSL_is_server(s) (s)->server
#endif
@@ -153,6 +156,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
+ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.13.0/src/event/ngx_event_openssl_stapling.c nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c
--- nginx-1.13.0/src/event/ngx_event_openssl_stapling.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-01 08:37:32.569863679 +1000
@@ -313,7 +313,9 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
+#ifdef WOLFSSL_NGINX
+ issuer = X509_dup(issuer);
+#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.13.0/src/http/modules/ngx_http_proxy_module.c nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.13.0/src/http/modules/ngx_http_proxy_module.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-01 08:37:32.569863679 +1000
@@ -4372,6 +4372,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
+
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.13.0/src/http/modules/ngx_http_ssl_module.c nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.13.0/src/http/modules/ngx_http_ssl_module.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-01 08:37:32.569863679 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.13.0/src/mail/ngx_mail_ssl_module.c nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c
--- nginx-1.13.0/src/mail/ngx_mail_ssl_module.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-01 08:37:32.569863679 +1000
@@ -10,7 +10,11 @@
#include <ngx_mail.h>
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.13.0/src/stream/ngx_stream_proxy_module.c nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c
--- nginx-1.13.0/src/stream/ngx_stream_proxy_module.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-01 08:37:32.569863679 +1000
@@ -2002,6 +2002,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, pscf->ssl);
+
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.13.0/src/stream/ngx_stream_ssl_module.c nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c
--- nginx-1.13.0/src/stream/ngx_stream_ssl_module.c 2017-04-26 00:18:23.000000000 +1000
+++ nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-01 08:37:32.569863679 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

4
nginx-1.13.2-wolfssl-debug.patch
View File

@ -1,6 +1,6 @@
diff -ur nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c nginx-1.13.2-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2017-06-29 10:18:05.421755825 +1000
+++ nginx-1.13.2-wolfssl-debug/src/event/ngx_event_openssl.c 2017-06-29 10:46:26.172278923 +1000
--- nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 09:02:23.968175319 +1000
+++ nginx-1.13.2-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-01 09:07:08.597382683 +1000
@@ -144,6 +144,11 @@
#endif

29
nginx-1.13.2-wolfssl.patch
View File

@ -64,7 +64,7 @@ diff -ur nginx-1.13.2/auto/options nginx-1.13.2-wolfssl/auto/options
diff -ur nginx-1.13.2/src/event/ngx_event_openssl.c nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.13.2/src/event/ngx_event_openssl.c 2017-06-28 00:44:20.000000000 +1000
+++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2017-06-29 10:18:05.421755825 +1000
+++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 09:02:23.968175319 +1000
@@ -346,6 +346,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
@ -91,11 +91,30 @@ diff -ur nginx-1.13.2/src/event/ngx_event_openssl.c nginx-1.13.2-wolfssl/src/eve
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
Only in nginx-1.13.2-wolfssl/src/event: .ngx_event_openssl.c.swp
@@ -1090,7 +1102,8 @@
* maximum interoperability.
*/
-#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST)
+#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) || \
+ defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
diff -ur nginx-1.13.2/src/event/ngx_event_openssl.h nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.13.2/src/event/ngx_event_openssl.h 2017-06-28 00:44:20.000000000 +1000
+++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.h 2017-06-29 10:33:37.484896533 +1000
@@ -54,7 +54,7 @@
+++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.h 2018-02-01 09:02:00.048075409 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -54,7 +57,7 @@
#define ngx_ssl_conn_t SSL
@ -104,7 +123,7 @@ diff -ur nginx-1.13.2/src/event/ngx_event_openssl.h nginx-1.13.2-wolfssl/src/eve
#define SSL_is_server(s) (s)->server
#endif
@@ -153,6 +153,7 @@
@@ -153,6 +156,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);

15
nginx-1.13.8-wolfssl-debug.patch 100644
View File

@ -0,0 +1,15 @@
diff -ur nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c nginx-1.13.8-wolfssl-debug/src/event/ngx_event_openssl.c
--- nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 10:10:29.701973701 +1000
+++ nginx-1.13.8-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 10:34:24.287926076 +1000
@@ -144,6 +144,11 @@
#endif
+#ifdef WOLFSSL_NGINX
+ /* Turn on internal wolfssl debugging to stdout */
+ wolfSSL_Debugging_ON();
+#endif
+
#if OPENSSL_VERSION_NUMBER >= 0x0090800fL
#ifndef SSL_OP_NO_COMPRESSION
{

237
nginx-1.13.8-wolfssl.patch 100644
View File

@ -0,0 +1,237 @@
diff -ur nginx-1.13.8/auto/lib/openssl/conf nginx-1.13.8-wolfssl/auto/lib/openssl/conf
--- nginx-1.13.8/auto/lib/openssl/conf 2017-12-27 02:01:12.000000000 +1000
+++ nginx-1.13.8-wolfssl/auto/lib/openssl/conf 2018-02-02 08:42:39.490622923 +1000
@@ -61,8 +61,33 @@
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+
+ if [ $WOLFSSL != NONE ]; then
+ ngx_feature="wolfSSL library in $WOLFSSL"
+ ngx_feature_path="$WOLFSSL/include/wolfssl"
+
+ if [ $NGX_RPATH = YES ]; then
+ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ else
+ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL"
+ fi
+
+ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
+ CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
+ fi
+
. auto/feature
+ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
+cat << END
+
+$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
+SSL modules require the wolfSSL library.
+
+END
+ exit 1
+ fi
+
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.13.8/auto/options nginx-1.13.8-wolfssl/auto/options
--- nginx-1.13.8/auto/options 2017-12-27 02:01:12.000000000 +1000
+++ nginx-1.13.8-wolfssl/auto/options 2018-02-02 08:42:39.490622923 +1000
@@ -144,6 +144,7 @@
USE_OPENSSL=NO
OPENSSL=NONE
+WOLFSSL=NONE
USE_ZLIB=NO
ZLIB=NONE
@@ -347,6 +348,7 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
+ --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
@@ -566,6 +568,7 @@
--with-libatomic force libatomic_ops library usage
--with-libatomic=DIR set path to libatomic_ops library sources
+ --with-wolfssl=DIR set path to wolfSSL headers and library
--with-openssl=DIR set path to OpenSSL library sources
--with-openssl-opt=OPTIONS set additional build options for OpenSSL
Only in nginx-1.13.8-wolfssl: conf.rej
diff -ur nginx-1.13.8/src/event/ngx_event_openssl.c nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.13.8/src/event/ngx_event_openssl.c 2017-12-27 02:01:12.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 10:10:29.701973701 +1000
@@ -346,6 +346,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
+#ifdef WOLFSSL_NGINX
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
+#endif
+
return NGX_OK;
}
@@ -654,6 +658,14 @@
ngx_int_t
+ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
+{
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
+
+ return NGX_OK;
+}
+
+ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1091,7 +1103,8 @@
* maximum interoperability.
*/
-#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST)
+#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) || \
+ defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3061,7 +3074,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3105,7 +3119,8 @@
size = 32;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.13.8/src/event/ngx_event_openssl.h nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.13.8/src/event/ngx_event_openssl.h 2017-12-27 02:01:12.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 08:42:39.494622923 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -55,7 +58,7 @@
#define ngx_ssl_conn_t SSL
-#if (OPENSSL_VERSION_NUMBER < 0x10002000L)
+#if (OPENSSL_VERSION_NUMBER < 0x10002000L) && !defined(WOLFSSL_NGINX)
#define SSL_is_server(s) (s)->server
#endif
@@ -154,6 +157,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
+ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.13.8/src/event/ngx_event_openssl_stapling.c nginx-1.13.8-wolfssl/src/event/ngx_event_openssl_stapling.c
--- nginx-1.13.8/src/event/ngx_event_openssl_stapling.c 2017-12-27 02:01:12.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 08:42:39.494622923 +1000
@@ -313,7 +313,9 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
+#ifdef WOLFSSL_NGINX
+ issuer = X509_dup(issuer);
+#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.13.8/src/http/modules/ngx_http_proxy_module.c nginx-1.13.8-wolfssl/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.13.8/src/http/modules/ngx_http_proxy_module.c 2017-12-27 02:01:13.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 08:42:39.494622923 +1000
@@ -4324,6 +4324,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
+
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.13.8/src/http/modules/ngx_http_ssl_module.c nginx-1.13.8-wolfssl/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.13.8/src/http/modules/ngx_http_ssl_module.c 2017-12-27 02:01:13.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 08:42:39.494622923 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.13.8/src/mail/ngx_mail_ssl_module.c nginx-1.13.8-wolfssl/src/mail/ngx_mail_ssl_module.c
--- nginx-1.13.8/src/mail/ngx_mail_ssl_module.c 2017-12-27 02:01:13.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 08:42:39.494622923 +1000
@@ -10,7 +10,11 @@
#include <ngx_mail.h>
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.13.8/src/stream/ngx_stream_proxy_module.c nginx-1.13.8-wolfssl/src/stream/ngx_stream_proxy_module.c
--- nginx-1.13.8/src/stream/ngx_stream_proxy_module.c 2017-12-27 02:01:13.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 08:42:39.494622923 +1000
@@ -2003,6 +2003,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, pscf->ssl);
+
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.13.8/src/stream/ngx_stream_ssl_module.c nginx-1.13.8-wolfssl/src/stream/ngx_stream_ssl_module.c
--- nginx-1.13.8/src/stream/ngx_stream_ssl_module.c 2017-12-27 02:01:13.000000000 +1000
+++ nginx-1.13.8-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 08:42:39.494622923 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"

49
test.sh
View File

@ -1,5 +1,7 @@
#!/bin/bash
NGINX_SRC="../nginx"
if [ "$NGINX_BIN" = "" ]; then
NGINX_BIN="${NGINX_SRC}/objs/nginx"
@ -10,6 +12,7 @@ fi
WOLFSSL_CLIENT="./examples/client/client"
WOLFSSL_OCSP_CERTS="${WOLFSSL_SOURCE}/certs/ocsp"
NGINX_CONF="./conf/nginx.conf"
NGINX_TLS13_CONF="./conf/nginx_tls13.conf"
CLIENT_TMP="/tmp/nginx_client.$$"
SERVER_TMP="/tmp/nginx_server.$$"
OCSP_GOOD="ocsp-good-status.der"
@ -25,6 +28,22 @@ if [ "$IPV6" != "" ]; then
fi
while [ $# -gt 0 ]
do
case $1 in
-tls13)
TLS13=1
NGINX_CONF=$NGINX_TLS13_CONF
;;
*)
echo "Unrecognized option: $1"
exit 1
;;
esac
shift
done
if [ ! -f $NGINX_BIN ]; then
echo "Could not find Nginx exe: ${NGINX_BIN}"
echo "Stopping - FAIL"
@ -235,19 +254,21 @@ echo '# ECC Certificate, ECDH Key Exchange: default curve (prime256v1)'
echo '#'
PORT=11446
echo "# Port: $PORT"
OPTS=
OPTS="-A certs/ca-ecc-cert.pem"
EXPECT=("SECP256R1" "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" "HTTP/1.1 200 OK")
client_test
# TLS v1.3
echo
echo '#'
echo '# TLS v1.3 client connecting to nginx server'
echo '#'
PORT=11447
echo "# Port: $PORT"
OPTS="-v 4"
EXPECT=("SECP256R1" "TLS_AES_128_GCM_SHA256" "HTTP/1.1 200 OK")
client_test
if [ "$TLS13" != "" ]; then
# TLS v1.3
echo
echo '#'
echo '# TLS v1.3 client connecting to nginx server'
echo '#'
PORT=11447
echo "# Port: $PORT"
OPTS="-v 4"
EXPECT=("SECP256R1" "TLS_AES_128_GCM_SHA256" "HTTP/1.1 200 OK")
client_test
fi
# Session tickets file
echo
echo '#'
@ -284,7 +305,11 @@ echo '#'
PORT=11457
echo "# Port: $PORT"
OPTS=
EXPECT=("reused session id" "HTTP/1.1 200 OK")
if [ "$TLS13" != "" ]; then
EXPECT=("HTTP/1.1 200 OK")
else
EXPECT=("reused session id" "HTTP/1.1 200 OK")
fi
client_test
# Proxy to localhost:11111 - DHE-RSA