From 259a5c8218caf185a0334c3816342f6eee683b0e Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Fri, 9 Feb 2018 11:49:19 +1000 Subject: [PATCH] Working with newest and patched wolfSSL --- README.md | 6 +- conf/ca-cert-ecc.pem | 67 ++-- conf/cert-ecc.pem | 68 ++-- conf/nginx.conf | 19 - conf/nginx_tls13.conf | 611 ++++++++++++++++++++++++++++++ nginx-1.10.3-wolfssl-debug.patch | 4 +- nginx-1.10.3-wolfssl.patch | 69 +++- nginx-1.11.10-wolfssl-debug.patch | 4 +- nginx-1.11.10-wolfssl.patch | 45 ++- nginx-1.11.13-wolfssl-debug.patch | 4 +- nginx-1.11.13-wolfssl.patch | 25 +- nginx-1.11.7-wolfssl-debug.patch | 4 +- nginx-1.11.7-wolfssl.patch | 45 ++- nginx-1.12.0-wolfssl-debug.patch | 4 +- nginx-1.12.0-wolfssl.patch | 45 ++- nginx-1.12.1-wolfssl-debug.patch | 238 ++++++++++++ nginx-1.12.1-wolfssl.patch | 226 +++++++++++ nginx-1.12.2-wolfssl-debug.patch | 238 ++++++++++++ nginx-1.12.2-wolfssl.patch | 226 +++++++++++ nginx-1.13.0-wolfssl-debug.patch | 208 ++++++++++ nginx-1.13.0-wolfssl.patch | 216 +++++++++++ nginx-1.13.2-wolfssl-debug.patch | 4 +- nginx-1.13.2-wolfssl.patch | 29 +- nginx-1.13.8-wolfssl-debug.patch | 15 + nginx-1.13.8-wolfssl.patch | 237 ++++++++++++ test.sh | 49 ++- 26 files changed, 2573 insertions(+), 133 deletions(-) create mode 100644 conf/nginx_tls13.conf create mode 100644 nginx-1.12.1-wolfssl-debug.patch create mode 100644 nginx-1.12.1-wolfssl.patch create mode 100644 nginx-1.12.2-wolfssl-debug.patch create mode 100644 nginx-1.12.2-wolfssl.patch create mode 100644 nginx-1.13.0-wolfssl-debug.patch create mode 100644 nginx-1.13.0-wolfssl.patch create mode 100644 nginx-1.13.8-wolfssl-debug.patch create mode 100644 nginx-1.13.8-wolfssl.patch diff --git a/README.md b/README.md index d3f909c..890ba90 100644 --- a/README.md +++ b/README.md @@ -6,8 +6,12 @@ wolfSSL is supported in Nginx. There are minor changes to the Nginx code base and recompilation is required. The tested versions: - - wolfSSL 3.11 + - wolfSSL 3.14 + - Nginx 1.13.8 - Nginx 1.13.2 + - Nginx 1.13.0 + - Nginx 1.12.2 + - Nginx 1.12.1 - Nginx 1.12.0 - Nginx 1.11.13 - Nginx 1.11.10 diff --git a/conf/ca-cert-ecc.pem b/conf/ca-cert-ecc.pem index 9c92c53..c292b14 100644 --- a/conf/ca-cert-ecc.pem +++ b/conf/ca-cert-ecc.pem @@ -2,55 +2,52 @@ Certificate: Data: Version: 3 (0x2) Serial Number: - ef:46:c7:a4:9b:bb:60:d3 + 97:b4:bd:16:78:f8:47:f2 Signature Algorithm: ecdsa-with-SHA256 - Issuer: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Issuer: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com Validity - Not Before: Aug 11 20:07:38 2016 GMT - Not After : May 8 20:07:38 2019 GMT - Subject: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Not Before: Oct 20 18:19:06 2017 GMT + Not After : Oct 15 18:19:06 2037 GMT + Subject: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com Subject Public Key Info: Public Key Algorithm: id-ecPublicKey Public-Key: (256 bit) pub: - 04:bb:33:ac:4c:27:50:4a:c6:4a:a5:04:c3:3c:de: - 9f:36:db:72:2d:ce:94:ea:2b:fa:cb:20:09:39:2c: - 16:e8:61:02:e9:af:4d:d3:02:93:9a:31:5b:97:92: - 21:7f:f0:cf:18:da:91:11:02:34:86:e8:20:58:33: - 0b:80:34:89:d8 + 04:02:d3:d9:6e:d6:01:8e:45:c8:b9:90:31:e5:c0: + 4c:e3:9e:ad:29:38:98:ba:10:d6:e9:09:2a:80:a9: + 2e:17:2a:b9:8a:bf:33:83:46:e3:95:0b:e4:77:40: + b5:3b:43:45:33:0f:61:53:7c:37:44:c1:cb:fc:80: + ca:e8:43:ea:a7 ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: X509v3 Subject Key Identifier: - 5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30 + 56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21 X509v3 Authority Key Identifier: - keyid:5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30 - DirName:/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com - serial:EF:46:C7:A4:9B:BB:60:D3 + keyid:56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21 - X509v3 Basic Constraints: + X509v3 Basic Constraints: critical CA:TRUE + X509v3 Key Usage: critical + Digital Signature, Certificate Sign, CRL Sign Signature Algorithm: ecdsa-with-SHA256 - 30:46:02:21:00:f1:d0:a6:3e:83:33:24:d1:7a:05:5f:1e:0e: - bd:7d:6b:33:e9:f2:86:f3:f3:3d:a9:ef:6a:87:31:b3:b7:7e: - 50:02:21:00:f0:60:dd:ce:a2:db:56:ec:d9:f4:e4:e3:25:d4: - b0:c9:25:7d:ca:7a:5d:ba:c4:b2:f6:7d:04:c7:bd:62:c9:20 + 30:45:02:20:32:26:81:e4:15:ec:e3:aa:d3:e5:b8:2a:ca:a3: + 06:a7:04:97:d8:43:7f:d4:94:47:f8:18:0d:93:52:23:8b:08: + 02:21:00:e1:9e:34:d0:92:ee:56:0d:23:38:4a:20:bc:cf:11: + c3:33:77:96:81:56:2b:ca:c4:d5:c6:65:5d:36:73:2f:ba -----BEGIN CERTIFICATE----- -MIIDEDCCArWgAwIBAgIJAO9Gx6Sbu2DTMAoGCCqGSM49BAMCMIGPMQswCQYDVQQG +MIICijCCAjCgAwIBAgIJAJe0vRZ4+EfyMAoGCCqGSM49BAMCMIGXMQswCQYDVQQG EwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEQMA4G -A1UECgwHRWxpcHRpYzEMMAoGA1UECwwDRUNDMRgwFgYDVQQDDA93d3cud29sZnNz -bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMTYwODEx -MjAwNzM4WhcNMTkwNTA4MjAwNzM4WjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgM -Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB0VsaXB0aWMx -DDAKBgNVBAsMA0VDQzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZI -hvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD -QgAEuzOsTCdQSsZKpQTDPN6fNttyLc6U6iv6yyAJOSwW6GEC6a9N0wKTmjFbl5Ih -f/DPGNqREQI0huggWDMLgDSJ2KOB9zCB9DAdBgNVHQ4EFgQUXV0m76x+NvmbdhUr -SiUCI++yiTAwgcQGA1UdIwSBvDCBuYAUXV0m76x+NvmbdhUrSiUCI++yiTChgZWk -gZIwgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH -DAdTZWF0dGxlMRAwDgYDVQQKDAdFbGlwdGljMQwwCgYDVQQLDANFQ0MxGDAWBgNV -BAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3Ns -LmNvbYIJAO9Gx6Sbu2DTMAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIh -APHQpj6DMyTRegVfHg69fWsz6fKG8/M9qe9qhzGzt35QAiEA8GDdzqLbVuzZ9OTj -JdSwySV9ynpdusSy9n0Ex71iySA= +A1UECgwHd29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGDAWBgNVBAMMD3d3 +dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTAe +Fw0xNzEwMjAxODE5MDZaFw0zNzEwMTUxODE5MDZaMIGXMQswCQYDVQQGEwJVUzET +MBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEQMA4GA1UECgwH +d29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxGDAWBgNVBAMMD3d3dy53b2xm +c3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqG +SM49AgEGCCqGSM49AwEHA0IABALT2W7WAY5FyLmQMeXATOOerSk4mLoQ1ukJKoCp +LhcquYq/M4NG45UL5HdAtTtDRTMPYVN8N0TBy/yAyuhD6qejYzBhMB0GA1UdDgQW +BBRWjprD8ELeGLlFVW75k8/qw/OlITAfBgNVHSMEGDAWgBRWjprD8ELeGLlFVW75 +k8/qw/OlITAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjAKBggqhkjO +PQQDAgNIADBFAiAyJoHkFezjqtPluCrKowanBJfYQ3/UlEf4GA2TUiOLCAIhAOGe +NNCS7lYNIzhKILzPEcMzd5aBVivKxNXGZV02cy+6 -----END CERTIFICATE----- diff --git a/conf/cert-ecc.pem b/conf/cert-ecc.pem index 9c92c53..b682974 100644 --- a/conf/cert-ecc.pem +++ b/conf/cert-ecc.pem @@ -1,13 +1,12 @@ Certificate: Data: Version: 3 (0x2) - Serial Number: - ef:46:c7:a4:9b:bb:60:d3 + Serial Number: 4096 (0x1000) Signature Algorithm: ecdsa-with-SHA256 - Issuer: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com + Issuer: C=US, ST=Washington, L=Seattle, O=wolfSSL, OU=Development, CN=www.wolfssl.com/emailAddress=info@wolfssl.com Validity - Not Before: Aug 11 20:07:38 2016 GMT - Not After : May 8 20:07:38 2019 GMT + Not Before: Oct 20 18:19:06 2017 GMT + Not After : Oct 18 18:19:06 2027 GMT Subject: C=US, ST=Washington, L=Seattle, O=Eliptic, OU=ECC, CN=www.wolfssl.com/emailAddress=info@wolfssl.com Subject Public Key Info: Public Key Algorithm: id-ecPublicKey @@ -21,36 +20,43 @@ Certificate: ASN1 OID: prime256v1 NIST CURVE: P-256 X509v3 extensions: + X509v3 Basic Constraints: + CA:FALSE + Netscape Cert Type: + SSL Server X509v3 Subject Key Identifier: 5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30 X509v3 Authority Key Identifier: - keyid:5D:5D:26:EF:AC:7E:36:F9:9B:76:15:2B:4A:25:02:23:EF:B2:89:30 - DirName:/C=US/ST=Washington/L=Seattle/O=Eliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com - serial:EF:46:C7:A4:9B:BB:60:D3 + keyid:56:8E:9A:C3:F0:42:DE:18:B9:45:55:6E:F9:93:CF:EA:C3:F3:A5:21 + DirName:/C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=info@wolfssl.com + serial:97:B4:BD:16:78:F8:47:F2 - X509v3 Basic Constraints: - CA:TRUE + X509v3 Key Usage: critical + Digital Signature, Key Encipherment, Key Agreement + X509v3 Extended Key Usage: + TLS Web Server Authentication Signature Algorithm: ecdsa-with-SHA256 - 30:46:02:21:00:f1:d0:a6:3e:83:33:24:d1:7a:05:5f:1e:0e: - bd:7d:6b:33:e9:f2:86:f3:f3:3d:a9:ef:6a:87:31:b3:b7:7e: - 50:02:21:00:f0:60:dd:ce:a2:db:56:ec:d9:f4:e4:e3:25:d4: - b0:c9:25:7d:ca:7a:5d:ba:c4:b2:f6:7d:04:c7:bd:62:c9:20 + 30:46:02:21:00:be:b8:58:f0:e4:15:01:1f:df:70:54:73:4a: + 6c:40:1f:77:a8:b4:eb:52:1e:bf:f5:0d:b1:33:ca:6a:c4:76: + b9:02:21:00:97:08:de:2c:28:c1:45:71:b6:2c:54:87:98:63: + 76:a8:21:34:90:a8:f7:9e:3f:fc:02:b0:e7:d3:09:31:27:e4 -----BEGIN CERTIFICATE----- -MIIDEDCCArWgAwIBAgIJAO9Gx6Sbu2DTMAoGCCqGSM49BAMCMIGPMQswCQYDVQQG -EwJVUzETMBEGA1UECAwKV2FzaGluZ3RvbjEQMA4GA1UEBwwHU2VhdHRsZTEQMA4G -A1UECgwHRWxpcHRpYzEMMAoGA1UECwwDRUNDMRgwFgYDVQQDDA93d3cud29sZnNz -bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMTYwODEx -MjAwNzM4WhcNMTkwNTA4MjAwNzM4WjCBjzELMAkGA1UEBhMCVVMxEzARBgNVBAgM -Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB0VsaXB0aWMx -DDAKBgNVBAsMA0VDQzEYMBYGA1UEAwwPd3d3LndvbGZzc2wuY29tMR8wHQYJKoZI -hvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcD -QgAEuzOsTCdQSsZKpQTDPN6fNttyLc6U6iv6yyAJOSwW6GEC6a9N0wKTmjFbl5Ih -f/DPGNqREQI0huggWDMLgDSJ2KOB9zCB9DAdBgNVHQ4EFgQUXV0m76x+NvmbdhUr -SiUCI++yiTAwgcQGA1UdIwSBvDCBuYAUXV0m76x+NvmbdhUrSiUCI++yiTChgZWk -gZIwgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQH -DAdTZWF0dGxlMRAwDgYDVQQKDAdFbGlwdGljMQwwCgYDVQQLDANFQ0MxGDAWBgNV -BAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3Ns -LmNvbYIJAO9Gx6Sbu2DTMAwGA1UdEwQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIh -APHQpj6DMyTRegVfHg69fWsz6fKG8/M9qe9qhzGzt35QAiEA8GDdzqLbVuzZ9OTj -JdSwySV9ynpdusSy9n0Ex71iySA= +MIIDUDCCAvWgAwIBAgICEAAwCgYIKoZIzj0EAwIwgZcxCzAJBgNVBAYTAlVTMRMw +EQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAd3 +b2xmU1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3LndvbGZz +c2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tMB4XDTE3MTAy +MDE4MTkwNloXDTI3MTAxODE4MTkwNlowgY8xCzAJBgNVBAYTAlVTMRMwEQYDVQQI +DApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYDVQQKDAdFbGlwdGlj +MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG +SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH +A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS +IX/wzxjakRECNIboIFgzC4A0idijggE1MIIBMTAJBgNVHRMEAjAAMBEGCWCGSAGG ++EIBAQQEAwIGQDAdBgNVHQ4EFgQUXV0m76x+NvmbdhUrSiUCI++yiTAwgcwGA1Ud +IwSBxDCBwYAUVo6aw/BC3hi5RVVu+ZPP6sPzpSGhgZ2kgZowgZcxCzAJBgNVBAYT +AlVTMRMwEQYDVQQIDApXYXNoaW5ndG9uMRAwDgYDVQQHDAdTZWF0dGxlMRAwDgYD +VQQKDAd3b2xmU1NMMRQwEgYDVQQLDAtEZXZlbG9wbWVudDEYMBYGA1UEAwwPd3d3 +LndvbGZzc2wuY29tMR8wHQYJKoZIhvcNAQkBFhBpbmZvQHdvbGZzc2wuY29tggkA +l7S9Fnj4R/IwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMAoG +CCqGSM49BAMCA0kAMEYCIQC+uFjw5BUBH99wVHNKbEAfd6i061Iev/UNsTPKasR2 +uQIhAJcI3iwowUVxtixUh5hjdqghNJCo954//AKw59MJMSfk -----END CERTIFICATE----- diff --git a/conf/nginx.conf b/conf/nginx.conf index 4e5b832..d289aeb 100644 --- a/conf/nginx.conf +++ b/conf/nginx.conf @@ -99,25 +99,6 @@ http { index index.html; } } - # Using TLS v1.3 - server { - listen 11447 ssl; - server_name localhost; - - ssl_certificate cert.pem; - ssl_certificate_key cert.key; - - ssl_session_cache shared:SSL:1m; - ssl_session_timeout 5m; - - ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; - ssl_prefer_server_ciphers on; - - location / { - root html; - index index.html; - } - } # Session ticket server { diff --git a/conf/nginx_tls13.conf b/conf/nginx_tls13.conf new file mode 100644 index 0000000..cb38cd2 --- /dev/null +++ b/conf/nginx_tls13.conf @@ -0,0 +1,611 @@ + +worker_processes 1; + +events { +} + + +http { + include mime.types; + default_type application/octet-stream; + + sendfile on; + + keepalive_timeout 65; + + ssl_session_tickets off; + + + # HTTPS server + + # Using DH parameters + server { + listen 11443 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Verify client + server { + listen 11444 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_client_certificate client-cert.pem; + ssl_verify_client on; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # P384 curve with ECDHE + server { + listen 11445 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_ecdh_curve secp384r1; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Default curve with ECDHE and ECDSA + server { + listen 11446 ssl; + server_name localhost; + + ssl_certificate cert-ecc.pem; + ssl_certificate_key cert-ecc-p8.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Using TLS v1.3 + server { + listen 11447 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + + # Session ticket + server { + listen 11450 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + ssl_session_ticket_key ticket_keys; + ssl_session_tickets on; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + + # Session cache off + server { + listen 11455 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache off; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Session cache none + server { + listen 11456 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache none; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Session cache builtin + server { + listen 11457 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache builtin:100; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + + # Proxy to wolfSSL server + upstream backend { + server 127.0.0.1:12443; + } + server { + listen 127.0.0.1:12443 ssl; + server_name www.wolfssl.com; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root wolfssl; + index index.html; + } + } + upstream backend_ecdhe_rsa { + server 127.0.0.1:12444; + } + server { + listen 127.0.0.1:12444 ssl; + server_name www.wolfssl.com; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root wolfssl; + index index.html; + } + } + upstream backend_ecdhe_ecdsa { + server 127.0.0.1:12445; + } + server { + listen 127.0.0.1:12445 ssl; + server_name www.wolfssl.com; + + ssl_certificate cert-ecc.pem; + ssl_certificate_key cert-ecc-priv.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root wolfssl; + index index.html; + } + } + upstream backend_crl_rev { + server 127.0.0.1:12446; + } + server { + listen 127.0.0.1:12446 ssl; + server_name www.wolfssl.com; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root wolfssl; + index index.html; + } + } + upstream backend_chain { + server 127.0.0.1:12447; + } + server { + listen 127.0.0.1:12447 ssl; + server_name ecc-3-leaf; + + ssl_certificate ecc-3-caleaf.crt; + ssl_certificate_key ecc-3-leaf.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root wolfssl; + index index.html; + } + } + upstream backend_bad_chain { + server 127.0.0.1:12448; + } + server { + listen 127.0.0.1:12448 ssl; + server_name ecc-3-leaf; + + ssl_certificate ecc-3-leaf.crt; + ssl_certificate_key ecc-3-leaf.key; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + ssl_prefer_server_ciphers on; + + location / { + root wolfssl; + index index.html; + } + } + + # Proxy using DHE cipher suites and CRL + server { + listen 11460 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass https://backend; + proxy_ssl_name www.wolfssl.com; + proxy_ssl_server_name on; + proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + proxy_ssl_trusted_certificate ca-cert.pem; + proxy_ssl_certificate client-cert.pem; + proxy_ssl_certificate_key client-key.pem; + proxy_ssl_verify on; + proxy_ssl_crl crl.pem; + } + } + # Proxy using ECDHE cipher suites and CRL + server { + listen 11461 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass https://backend_ecdhe_rsa; + proxy_ssl_name www.wolfssl.com; + proxy_ssl_server_name on; + proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + proxy_ssl_trusted_certificate ca-cert.pem; + proxy_ssl_certificate client-cert.pem; + proxy_ssl_certificate_key client-key.pem; + proxy_ssl_verify on; + proxy_ssl_crl crl.pem; + } + } + # Proxy using ECDHE and ECDSA cipher suites + server { + listen 11462 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass https://backend_ecdhe_ecdsa; + proxy_ssl_name www.wolfssl.com; + proxy_ssl_server_name on; + proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + proxy_ssl_trusted_certificate ca-cert-ecc.pem; + proxy_ssl_certificate client-cert.pem; + proxy_ssl_certificate_key client-key.pem; + proxy_ssl_verify on; + proxy_ssl_session_reuse on; + } + } + # Proxy using complete chain + server { + listen 11463 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass https://backend_chain; + proxy_ssl_name ecc-3-leaf; + proxy_ssl_server_name on; + proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + proxy_ssl_trusted_certificate ecc-3-root.crt; + proxy_ssl_certificate client-cert.pem; + proxy_ssl_certificate_key client-key.pem; + proxy_ssl_verify on; + proxy_ssl_session_reuse on; + } + } + # Proxy using incomplete chain + server { + listen 11464 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass https://backend_bad_chain; + proxy_ssl_name ecc-3-leaf; + proxy_ssl_server_name on; + proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + proxy_ssl_trusted_certificate ecc-3-root.crt; + proxy_ssl_certificate client-cert.pem; + proxy_ssl_certificate_key client-key.pem; + proxy_ssl_verify on; + proxy_ssl_session_reuse on; + } + } + + + # Proxy using revoked CRL + server { + listen 11465 ssl; + server_name localhost; + + ssl_certificate cert.pem; + ssl_certificate_key cert.key; + ssl_dhparam dhparams.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + proxy_pass https://backend_crl_rev; + proxy_ssl_name www.wolfssl.com; + proxy_ssl_server_name on; + proxy_ssl_ciphers TLS13-AES128-GCM-SHA256:TLS13-AES256-GCM-SHA384; + proxy_ssl_trusted_certificate ca-cert.pem; + proxy_ssl_certificate client-cert.pem; + proxy_ssl_certificate_key client-key.pem; + proxy_ssl_verify on; + proxy_ssl_crl crl-revoked.pem; + proxy_ssl_session_reuse on; + } + } + # OCSP Stapling + # Valid server certificate - using OCSP responder + server { + listen 11470 ssl; + server_name localhost; + + ssl_certificate ocsp-good-cert.pem; + ssl_certificate_key ocsp-good-key.pem; + ssl_stapling on; + ssl_stapling_responder http://127.0.0.1:22221; + ssl_stapling_verify on; + ssl_trusted_certificate ocsp-root-resp-cert.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Revoked server certificate - using OCSP responder + server { + listen 11471 ssl; + server_name localhost; + + ssl_certificate ocsp-bad-cert.pem; + ssl_certificate_key ocsp-bad-key.pem; + ssl_stapling on; + ssl_stapling_responder http://127.0.0.1:22221; + ssl_trusted_certificate ocsp-root-resp-cert.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Valid server certificate in fixed OCSP response + server { + listen 11472 ssl; + server_name localhost; + + ssl_certificate ocsp-good-cert.pem; + ssl_certificate_key ocsp-good-key.pem; + ssl_stapling on; + ssl_stapling_file ocsp-good-status.der; + ssl_trusted_certificate ocsp-root-resp-cert.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # Revoked server certificate in fixed OCSP response + server { + listen 11473 ssl; + server_name localhost; + + ssl_certificate ocsp-bad-cert.pem; + ssl_certificate_key ocsp-bad-key.pem; + ssl_stapling on; + ssl_stapling_file ocsp-bad-status.der; + ssl_trusted_certificate ocsp-root-resp-cert.pem; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } + # No CA to check responder certificate - using OCSP responder + server { + listen 11474 ssl; + server_name localhost; + + ssl_certificate ocsp-good-cert.pem; + ssl_certificate_key ocsp-good-key.pem; + ssl_stapling on; + ssl_stapling_responder http://127.0.0.1:22221; + ssl_stapling_verify on; + + ssl_session_cache shared:SSL:1m; + ssl_session_timeout 5m; + + ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-SHA:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES128-SHA; + ssl_prefer_server_ciphers on; + + location / { + root html; + index index.html; + } + } +} diff --git a/nginx-1.10.3-wolfssl-debug.patch b/nginx-1.10.3-wolfssl-debug.patch index 61b87d4..6f6a9f0 100644 --- a/nginx-1.10.3-wolfssl-debug.patch +++ b/nginx-1.10.3-wolfssl-debug.patch @@ -1,6 +1,6 @@ diff -ur nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl-debug/src/event/ngx_event_openssl.c ---- nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:37:30.867368905 +1000 -+++ nginx-1.10.3-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:02.561501608 +1000 +--- nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:21:43.593980737 +1000 ++++ nginx-1.10.3-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 09:22:03.135202985 +1000 @@ -128,6 +128,11 @@ #endif diff --git a/nginx-1.10.3-wolfssl.patch b/nginx-1.10.3-wolfssl.patch index 0cbec99..f0aa49b 100644 --- a/nginx-1.10.3-wolfssl.patch +++ b/nginx-1.10.3-wolfssl.patch @@ -57,7 +57,7 @@ diff -ur nginx-1.10.3/auto/options nginx-1.10.3-wolfssl/auto/options diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c --- nginx-1.10.3/src/event/ngx_event_openssl.c 2017-02-01 01:01:11.000000000 +1000 -+++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:37:30.867368905 +1000 ++++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:21:43.593980737 +1000 @@ -55,7 +55,7 @@ HMAC_CTX *hctx, int enc); #endif @@ -101,7 +101,54 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, -@@ -2971,6 +2980,11 @@ +@@ -1019,6 +1028,38 @@ + { + #if OPENSSL_VERSION_NUMBER >= 0x0090800fL + #ifndef OPENSSL_NO_ECDH ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) ++ ++ /* ++ * OpenSSL 1.0.2+ allows configuring a curve list instead of a single ++ * curve previously supported. By default an internal list is used, ++ * with prime256v1 being preferred by server in OpenSSL 1.0.2b+ ++ * and X25519 in OpenSSL 1.1.0+. ++ * ++ * By default a curve preferred by the client will be used for ++ * key exchange. The SSL_OP_CIPHER_SERVER_PREFERENCE option can ++ * be used to prefer server curves instead, similar to what it ++ * does for ciphers. ++ */ ++ ++ SSL_CTX_set_options(ssl->ctx, SSL_OP_SINGLE_ECDH_USE); ++ ++#if SSL_CTRL_SET_ECDH_AUTO ++ /* not needed in OpenSSL 1.1.0+ */ ++ SSL_CTX_set_ecdh_auto(ssl->ctx, 1); ++#endif ++ ++ if (ngx_strcmp(name->data, "auto") == 0) { ++ return NGX_OK; ++ } ++ ++ if (SSL_CTX_set1_curves_list(ssl->ctx, (char *) name->data) == 0) { ++ ngx_ssl_error(NGX_LOG_EMERG, ssl->log, 0, ++ "SSL_CTX_set1_curves_list(\"%s\") failed", name->data); ++ return NGX_ERROR; ++ } ++ ++#else + int nid; + EC_KEY *ecdh; + +@@ -1050,6 +1091,7 @@ + EC_KEY_free(ecdh); + #endif + #endif ++#endif + + return NGX_OK; + } +@@ -2971,6 +3013,11 @@ ngx_ssl_cleanup_ctx(void *data) { ngx_ssl_t *ssl = data; @@ -113,7 +160,7 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve SSL_CTX_free(ssl->ctx); } -@@ -2986,7 +3000,7 @@ +@@ -2986,7 +3033,7 @@ return NGX_ERROR; } @@ -122,7 +169,7 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve /* X509_check_host() is only available in OpenSSL 1.0.2+ */ -@@ -3103,7 +3117,7 @@ +@@ -3103,7 +3150,7 @@ } @@ -133,8 +180,18 @@ diff -ur nginx-1.10.3/src/event/ngx_event_openssl.c nginx-1.10.3-wolfssl/src/eve ngx_ssl_check_name(ngx_str_t *name, ASN1_STRING *pattern) diff -ur nginx-1.10.3/src/event/ngx_event_openssl.h nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.h --- nginx-1.10.3/src/event/ngx_event_openssl.h 2017-02-01 01:01:11.000000000 +1000 -+++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 15:37:15.307255249 +1000 -@@ -142,6 +142,7 @@ ++++ nginx-1.10.3-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:09:01.157341959 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -142,6 +145,7 @@ ngx_int_t ngx_ssl_create(ngx_ssl_t *ssl, ngx_uint_t protocols, void *data); ngx_int_t ngx_ssl_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); diff --git a/nginx-1.11.10-wolfssl-debug.patch b/nginx-1.11.10-wolfssl-debug.patch index 9bda45e..8d18bb0 100644 --- a/nginx-1.11.10-wolfssl-debug.patch +++ b/nginx-1.11.10-wolfssl-debug.patch @@ -1,6 +1,6 @@ diff -ur nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c nginx-1.11.10-wolfssl-debug/src/event/ngx_event_openssl.c ---- nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:53:51.151297965 +1000 -+++ nginx-1.11.10-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:18.269591752 +1000 +--- nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:26:50.942730388 +1000 ++++ nginx-1.11.10-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 14:27:40.675012575 +1000 @@ -144,6 +144,11 @@ #endif diff --git a/nginx-1.11.10-wolfssl.patch b/nginx-1.11.10-wolfssl.patch index 73cb801..fa0e9dc 100644 --- a/nginx-1.11.10-wolfssl.patch +++ b/nginx-1.11.10-wolfssl.patch @@ -56,7 +56,7 @@ diff -ur nginx-1.11.10/auto/options nginx-1.11.10-wolfssl/auto/options diff -ur nginx-1.11.10/src/event/ngx_event_openssl.c nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c --- nginx-1.11.10/src/event/ngx_event_openssl.c 2017-02-15 01:36:05.000000000 +1000 -+++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:53:51.151297965 +1000 ++++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:26:50.942730388 +1000 @@ -340,6 +340,10 @@ SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); @@ -83,10 +83,49 @@ diff -ur nginx-1.11.10/src/event/ngx_event_openssl.c nginx-1.11.10-wolfssl/src/e ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth) { +@@ -1082,7 +1094,7 @@ + * maximum interoperability. + */ + +-#ifdef SSL_CTRL_SET_CURVES_LIST ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3050,7 +3062,8 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3094,7 +3107,8 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; diff -ur nginx-1.11.10/src/event/ngx_event_openssl.h nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.h --- nginx-1.11.10/src/event/ngx_event_openssl.h 2017-02-15 01:36:05.000000000 +1000 -+++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 14:54:11.115369454 +1000 -@@ -147,6 +147,7 @@ ++++ nginx-1.11.10-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:08:26.869420014 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -147,6 +150,7 @@ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, ngx_uint_t prefer_server_ciphers); diff --git a/nginx-1.11.13-wolfssl-debug.patch b/nginx-1.11.13-wolfssl-debug.patch index 2d4ecba..30af2c8 100644 --- a/nginx-1.11.13-wolfssl-debug.patch +++ b/nginx-1.11.13-wolfssl-debug.patch @@ -1,6 +1,6 @@ diff -ur nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c nginx-1.11.13-wolfssl-debug/src/event/ngx_event_openssl.c ---- nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:07:53.569430271 +1000 -+++ nginx-1.11.13-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:20.801606211 +1000 +--- nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:07:36.997535505 +1000 ++++ nginx-1.11.13-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 09:07:52.965498263 +1000 @@ -144,6 +144,11 @@ #endif diff --git a/nginx-1.11.13-wolfssl.patch b/nginx-1.11.13-wolfssl.patch index 673fd35..5c7ee16 100644 --- a/nginx-1.11.13-wolfssl.patch +++ b/nginx-1.11.13-wolfssl.patch @@ -64,7 +64,7 @@ diff -ur nginx-1.11.13/auto/options nginx-1.11.13-wolfssl/auto/options diff -ur nginx-1.11.13/src/event/ngx_event_openssl.c nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c --- nginx-1.11.13/src/event/ngx_event_openssl.c 2017-04-05 01:01:57.000000000 +1000 -+++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:07:53.569430271 +1000 ++++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 09:07:36.997535505 +1000 @@ -340,6 +340,10 @@ SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); @@ -91,10 +91,29 @@ diff -ur nginx-1.11.13/src/event/ngx_event_openssl.c nginx-1.11.13-wolfssl/src/e ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth) { +@@ -1082,7 +1094,7 @@ + * maximum interoperability. + */ + +-#ifdef SSL_CTRL_SET_CURVES_LIST ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single diff -ur nginx-1.11.13/src/event/ngx_event_openssl.h nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.h --- nginx-1.11.13/src/event/ngx_event_openssl.h 2017-04-05 01:01:57.000000000 +1000 -+++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 15:08:11.385467468 +1000 -@@ -147,6 +147,7 @@ ++++ nginx-1.11.13-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:07:12.437593298 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -147,6 +150,7 @@ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, ngx_uint_t prefer_server_ciphers); diff --git a/nginx-1.11.7-wolfssl-debug.patch b/nginx-1.11.7-wolfssl-debug.patch index 59991f6..bd2c7bb 100644 --- a/nginx-1.11.7-wolfssl-debug.patch +++ b/nginx-1.11.7-wolfssl-debug.patch @@ -1,6 +1,6 @@ diff -ur nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl-debug/src/event/ngx_event_openssl.c ---- nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:47:08.313886491 +1000 -+++ nginx-1.11.7-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:23.309620512 +1000 +--- nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:27:14.826866032 +1000 ++++ nginx-1.11.7-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 14:28:01.823132284 +1000 @@ -134,6 +134,11 @@ #endif diff --git a/nginx-1.11.7-wolfssl.patch b/nginx-1.11.7-wolfssl.patch index b72cf0e..2e03cde 100644 --- a/nginx-1.11.7-wolfssl.patch +++ b/nginx-1.11.7-wolfssl.patch @@ -56,7 +56,7 @@ diff -ur nginx-1.11.7/auto/options nginx-1.11.7-wolfssl/auto/options diff -ur nginx-1.11.7/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c --- nginx-1.11.7/src/event/ngx_event_openssl.c 2016-12-14 01:21:24.000000000 +1000 -+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 14:47:08.313886491 +1000 ++++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:27:14.826866032 +1000 @@ -330,6 +330,10 @@ SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); @@ -83,10 +83,49 @@ diff -ur nginx-1.11.7/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl/src/eve ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth) { +@@ -1072,7 +1084,7 @@ + * maximum interoperability. + */ + +-#ifdef SSL_CTRL_SET_CURVES_LIST ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3019,7 +3031,8 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[0].hmac_key, 16, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3054,7 +3067,8 @@ + ngx_hex_dump(buf, key[i].name, 16) - buf, buf, + (i == 0) ? " (default)" : ""); + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[i].hmac_key, 16, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; diff -ur nginx-1.11.7/src/event/ngx_event_openssl.h nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h --- nginx-1.11.7/src/event/ngx_event_openssl.h 2016-12-14 01:21:24.000000000 +1000 -+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 14:49:57.150469616 +1000 -@@ -146,6 +146,7 @@ ++++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:01:17.610518828 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -146,6 +149,7 @@ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, ngx_uint_t prefer_server_ciphers); diff --git a/nginx-1.12.0-wolfssl-debug.patch b/nginx-1.12.0-wolfssl-debug.patch index 13d93ff..f5a3810 100644 --- a/nginx-1.12.0-wolfssl-debug.patch +++ b/nginx-1.12.0-wolfssl-debug.patch @@ -1,6 +1,6 @@ diff -ur nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c nginx-1.12.0-wolfssl-debug/src/event/ngx_event_openssl.c ---- nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:05:43.741185370 +1000 -+++ nginx-1.12.0-wolfssl-debug/src/event/ngx_event_openssl.c 2017-04-13 15:43:26.645639503 +1000 +--- nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:04:48.653303612 +1000 ++++ nginx-1.12.0-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 11:05:10.313347727 +1000 @@ -144,6 +144,11 @@ #endif diff --git a/nginx-1.12.0-wolfssl.patch b/nginx-1.12.0-wolfssl.patch index 7445771..bfd1ff0 100644 --- a/nginx-1.12.0-wolfssl.patch +++ b/nginx-1.12.0-wolfssl.patch @@ -64,7 +64,7 @@ diff -ur nginx-1.12.0/auto/options nginx-1.12.0-wolfssl/auto/options diff -ur nginx-1.12.0/src/event/ngx_event_openssl.c nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c --- nginx-1.12.0/src/event/ngx_event_openssl.c 2017-04-13 00:46:01.000000000 +1000 -+++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2017-04-13 15:05:43.741185370 +1000 ++++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:04:48.653303612 +1000 @@ -340,6 +340,10 @@ SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); @@ -91,10 +91,49 @@ diff -ur nginx-1.12.0/src/event/ngx_event_openssl.c nginx-1.12.0-wolfssl/src/eve ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth) { +@@ -1082,7 +1094,7 @@ + * maximum interoperability. + */ + +-#ifdef SSL_CTRL_SET_CURVES_LIST ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3050,7 +3062,8 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3094,7 +3107,8 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; diff -ur nginx-1.12.0/src/event/ngx_event_openssl.h nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.h --- nginx-1.12.0/src/event/ngx_event_openssl.h 2017-04-13 00:46:01.000000000 +1000 -+++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.h 2017-04-13 15:06:02.777218149 +1000 -@@ -147,6 +147,7 @@ ++++ nginx-1.12.0-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 08:50:02.145284612 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -147,6 +150,7 @@ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, ngx_uint_t prefer_server_ciphers); diff --git a/nginx-1.12.1-wolfssl-debug.patch b/nginx-1.12.1-wolfssl-debug.patch new file mode 100644 index 0000000..fbcd7db --- /dev/null +++ b/nginx-1.12.1-wolfssl-debug.patch @@ -0,0 +1,238 @@ +diff -ur nginx-1.12.1-wolfssl/auto/lib/openssl/conf nginx-1.12.1-wolfssl-debug/auto/lib/openssl/conf +--- nginx-1.12.1-wolfssl/auto/lib/openssl/conf 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/auto/lib/openssl/conf 2018-02-02 11:12:46.602768290 +1000 +@@ -61,33 +61,8 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" +- +- if [ $WOLFSSL != NONE ]; then +- ngx_feature="wolfSSL library in $WOLFSSL" +- ngx_feature_path="$WOLFSSL/include/wolfssl" +- +- if [ $NGX_RPATH = YES ]; then +- ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" +- else +- ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" +- fi +- +- CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" +- CFLAGS="$CFLAGS -DWOLFSSL_NGINX" +- fi +- + . auto/feature + +- if [ $WOLFSSL != NONE -a $ngx_found = no ]; then +-cat << END +- +-$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. +-SSL modules require the wolfSSL library. +- +-END +- exit 1 +- fi +- + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.12.1-wolfssl/auto/options nginx-1.12.1-wolfssl-debug/auto/options +--- nginx-1.12.1-wolfssl/auto/options 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/auto/options 2018-02-02 11:12:46.602768290 +1000 +@@ -143,7 +143,6 @@ + + USE_OPENSSL=NO + OPENSSL=NONE +-WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -346,7 +345,6 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + +- --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -565,7 +563,6 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + +- --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +diff -ur nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.c +--- nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 11:14:10.811101939 +1000 +@@ -144,6 +144,11 @@ + + #endif + ++#ifdef WOLFSSL_NGINX ++ /* Turn on internal wolfssl debugging to stdout */ ++ wolfSSL_Debugging_ON(); ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x0090800fL + #ifndef SSL_OP_NO_COMPRESSION + { +@@ -340,10 +345,6 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + +-#ifdef WOLFSSL_NGINX +- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); +-#endif +- + return NGX_OK; + } + +@@ -652,14 +653,6 @@ + + + ngx_int_t +-ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) +-{ +- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); +- +- return NGX_OK; +-} +- +-ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +@@ -1094,7 +1087,7 @@ + * maximum interoperability. + */ + +-#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) ++#ifdef SSL_CTRL_SET_CURVES_LIST + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3062,8 +3055,7 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ +- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3107,8 +3099,7 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ +- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +diff -ur nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.h +--- nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl.h 2018-02-02 11:12:46.606768306 +1000 +@@ -12,9 +12,6 @@ + #include + #include + +-#ifdef WOLFSSL_NGINX +-#include +-#endif + #include + #include + #include +@@ -150,7 +147,6 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); +-ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl_stapling.c +--- nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:12:46.606768306 +1000 +@@ -313,9 +313,7 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#ifdef WOLFSSL_NGINX +- issuer = X509_dup(issuer); +-#elif OPENSSL_VERSION_NUMBER >= 0x10100001L ++#if OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:12:46.610768321 +1000 +@@ -4371,8 +4371,6 @@ + return NGX_ERROR; + } + +- ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); +- + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:12:46.610768321 +1000 +@@ -14,11 +14,7 @@ + ngx_pool_t *pool, ngx_str_t *s); + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c nginx-1.12.1-wolfssl-debug/src/mail/ngx_mail_ssl_module.c +--- nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:12:46.614768337 +1000 +@@ -10,11 +10,7 @@ + #include + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_proxy_module.c +--- nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:12:46.618768352 +1000 +@@ -2001,8 +2001,6 @@ + return NGX_ERROR; + } + +- ngx_ssl_set_verify_on(cf, pscf->ssl); +- + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_ssl_module.c +--- nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:14:00.503060273 +1000 ++++ nginx-1.12.1-wolfssl-debug/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:12:46.618768352 +1000 +@@ -14,11 +14,7 @@ + ngx_pool_t *pool, ngx_str_t *s); + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/nginx-1.12.1-wolfssl.patch b/nginx-1.12.1-wolfssl.patch new file mode 100644 index 0000000..691fc69 --- /dev/null +++ b/nginx-1.12.1-wolfssl.patch @@ -0,0 +1,226 @@ +diff -ur nginx-1.12.1/auto/lib/openssl/conf nginx-1.12.1-wolfssl/auto/lib/openssl/conf +--- nginx-1.12.1/auto/lib/openssl/conf 2017-07-11 23:24:06.000000000 +1000 ++++ nginx-1.12.1-wolfssl/auto/lib/openssl/conf 2018-02-02 11:14:00.503060273 +1000 +@@ -61,8 +61,33 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" ++ ++ if [ $WOLFSSL != NONE ]; then ++ ngx_feature="wolfSSL library in $WOLFSSL" ++ ngx_feature_path="$WOLFSSL/include/wolfssl" ++ ++ if [ $NGX_RPATH = YES ]; then ++ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ else ++ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ fi ++ ++ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" ++ CFLAGS="$CFLAGS -DWOLFSSL_NGINX" ++ fi ++ + . auto/feature + ++ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then ++cat << END ++ ++$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. ++SSL modules require the wolfSSL library. ++ ++END ++ exit 1 ++ fi ++ + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.12.1/auto/options nginx-1.12.1-wolfssl/auto/options +--- nginx-1.12.1/auto/options 2017-07-11 23:24:06.000000000 +1000 ++++ nginx-1.12.1-wolfssl/auto/options 2018-02-02 11:14:00.503060273 +1000 +@@ -143,6 +143,7 @@ + + USE_OPENSSL=NO + OPENSSL=NONE ++WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -345,6 +346,7 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + ++ --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -563,6 +565,7 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + ++ --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +diff -ur nginx-1.12.1/src/event/ngx_event_openssl.c nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c +--- nginx-1.12.1/src/event/ngx_event_openssl.c 2017-07-11 23:24:07.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:14:00.503060273 +1000 +@@ -340,6 +340,10 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + ++#ifdef WOLFSSL_NGINX ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); ++#endif ++ + return NGX_OK; + } + +@@ -648,6 +652,14 @@ + + + ngx_int_t ++ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) ++{ ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); ++ ++ return NGX_OK; ++} ++ ++ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +@@ -1082,7 +1094,7 @@ + * maximum interoperability. + */ + +-#ifdef SSL_CTRL_SET_CURVES_LIST ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3050,7 +3062,8 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3094,7 +3107,8 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +diff -ur nginx-1.12.1/src/event/ngx_event_openssl.h nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h +--- nginx-1.12.1/src/event/ngx_event_openssl.h 2017-07-11 23:24:07.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:14:00.503060273 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -147,6 +150,7 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); ++ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.12.1/src/event/ngx_event_openssl_stapling.c nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c +--- nginx-1.12.1/src/event/ngx_event_openssl_stapling.c 2017-07-11 23:24:07.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:14:00.503060273 +1000 +@@ -313,7 +313,9 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#if OPENSSL_VERSION_NUMBER >= 0x10100001L ++#ifdef WOLFSSL_NGINX ++ issuer = X509_dup(issuer); ++#elif OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.12.1/src/http/modules/ngx_http_proxy_module.c nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.12.1/src/http/modules/ngx_http_proxy_module.c 2017-07-11 23:24:08.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:14:00.503060273 +1000 +@@ -4371,6 +4371,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); ++ + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.12.1/src/http/modules/ngx_http_ssl_module.c nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.12.1/src/http/modules/ngx_http_ssl_module.c 2017-07-11 23:24:08.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:14:00.503060273 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.12.1/src/mail/ngx_mail_ssl_module.c nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c +--- nginx-1.12.1/src/mail/ngx_mail_ssl_module.c 2017-07-11 23:24:10.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:14:00.503060273 +1000 +@@ -10,7 +10,11 @@ + #include + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.12.1/src/stream/ngx_stream_proxy_module.c nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c +--- nginx-1.12.1/src/stream/ngx_stream_proxy_module.c 2017-07-11 23:24:11.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:14:00.503060273 +1000 +@@ -2001,6 +2001,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, pscf->ssl); ++ + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.12.1/src/stream/ngx_stream_ssl_module.c nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c +--- nginx-1.12.1/src/stream/ngx_stream_ssl_module.c 2017-07-11 23:24:11.000000000 +1000 ++++ nginx-1.12.1-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:14:00.503060273 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/nginx-1.12.2-wolfssl-debug.patch b/nginx-1.12.2-wolfssl-debug.patch new file mode 100644 index 0000000..4fe9ee4 --- /dev/null +++ b/nginx-1.12.2-wolfssl-debug.patch @@ -0,0 +1,238 @@ +diff -ur nginx-1.12.2-wolfssl/auto/lib/openssl/conf nginx-1.12.2-wolfssl-debug/auto/lib/openssl/conf +--- nginx-1.12.2-wolfssl/auto/lib/openssl/conf 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/auto/lib/openssl/conf 2018-02-02 11:13:06.954847473 +1000 +@@ -61,33 +61,8 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" +- +- if [ $WOLFSSL != NONE ]; then +- ngx_feature="wolfSSL library in $WOLFSSL" +- ngx_feature_path="$WOLFSSL/include/wolfssl" +- +- if [ $NGX_RPATH = YES ]; then +- ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" +- else +- ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" +- fi +- +- CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" +- CFLAGS="$CFLAGS -DWOLFSSL_NGINX" +- fi +- + . auto/feature + +- if [ $WOLFSSL != NONE -a $ngx_found = no ]; then +-cat << END +- +-$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. +-SSL modules require the wolfSSL library. +- +-END +- exit 1 +- fi +- + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.12.2-wolfssl/auto/options nginx-1.12.2-wolfssl-debug/auto/options +--- nginx-1.12.2-wolfssl/auto/options 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/auto/options 2018-02-02 11:13:06.954847473 +1000 +@@ -143,7 +143,6 @@ + + USE_OPENSSL=NO + OPENSSL=NONE +-WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -346,7 +345,6 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + +- --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -565,7 +563,6 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + +- --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +diff -ur nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.c +--- nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 11:13:47.819009306 +1000 +@@ -144,6 +144,11 @@ + + #endif + ++#ifdef WOLFSSL_NGINX ++ /* Turn on internal wolfssl debugging to stdout */ ++ wolfSSL_Debugging_ON(); ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x0090800fL + #ifndef SSL_OP_NO_COMPRESSION + { +@@ -340,10 +345,6 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + +-#ifdef WOLFSSL_NGINX +- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); +-#endif +- + return NGX_OK; + } + +@@ -652,14 +653,6 @@ + + + ngx_int_t +-ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) +-{ +- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); +- +- return NGX_OK; +-} +- +-ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +@@ -1094,7 +1087,7 @@ + * maximum interoperability. + */ + +-#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) ++#ifdef SSL_CTRL_SET_CURVES_LIST + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3062,8 +3055,7 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ +- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3107,8 +3099,7 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ +- (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +diff -ur nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.h +--- nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl.h 2018-02-02 11:13:06.958847490 +1000 +@@ -12,9 +12,6 @@ + #include + #include + +-#ifdef WOLFSSL_NGINX +-#include +-#endif + #include + #include + #include +@@ -150,7 +147,6 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); +-ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl_stapling.c +--- nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:13:06.958847490 +1000 +@@ -313,9 +313,7 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#ifdef WOLFSSL_NGINX +- issuer = X509_dup(issuer); +-#elif OPENSSL_VERSION_NUMBER >= 0x10100001L ++#if OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:13:06.962847505 +1000 +@@ -4371,8 +4371,6 @@ + return NGX_ERROR; + } + +- ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); +- + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:13:34.994958124 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:13:06.962847505 +1000 +@@ -14,11 +14,7 @@ + ngx_pool_t *pool, ngx_str_t *s); + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c nginx-1.12.2-wolfssl-debug/src/mail/ngx_mail_ssl_module.c +--- nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:13:34.998958139 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:13:06.966847521 +1000 +@@ -10,11 +10,7 @@ + #include + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_proxy_module.c +--- nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:13:34.998958139 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:13:06.970847536 +1000 +@@ -2005,8 +2005,6 @@ + return NGX_ERROR; + } + +- ngx_ssl_set_verify_on(cf, pscf->ssl); +- + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_ssl_module.c +--- nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:13:34.998958139 +1000 ++++ nginx-1.12.2-wolfssl-debug/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:13:06.970847536 +1000 +@@ -14,11 +14,7 @@ + ngx_pool_t *pool, ngx_str_t *s); + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/nginx-1.12.2-wolfssl.patch b/nginx-1.12.2-wolfssl.patch new file mode 100644 index 0000000..48da512 --- /dev/null +++ b/nginx-1.12.2-wolfssl.patch @@ -0,0 +1,226 @@ +diff -ur nginx-1.12.2/auto/lib/openssl/conf nginx-1.12.2-wolfssl/auto/lib/openssl/conf +--- nginx-1.12.2/auto/lib/openssl/conf 2017-10-17 23:16:37.000000000 +1000 ++++ nginx-1.12.2-wolfssl/auto/lib/openssl/conf 2018-02-02 11:13:34.994958124 +1000 +@@ -61,8 +61,33 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" ++ ++ if [ $WOLFSSL != NONE ]; then ++ ngx_feature="wolfSSL library in $WOLFSSL" ++ ngx_feature_path="$WOLFSSL/include/wolfssl" ++ ++ if [ $NGX_RPATH = YES ]; then ++ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ else ++ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ fi ++ ++ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" ++ CFLAGS="$CFLAGS -DWOLFSSL_NGINX" ++ fi ++ + . auto/feature + ++ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then ++cat << END ++ ++$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. ++SSL modules require the wolfSSL library. ++ ++END ++ exit 1 ++ fi ++ + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.12.2/auto/options nginx-1.12.2-wolfssl/auto/options +--- nginx-1.12.2/auto/options 2017-10-17 23:16:37.000000000 +1000 ++++ nginx-1.12.2-wolfssl/auto/options 2018-02-02 11:13:34.994958124 +1000 +@@ -143,6 +143,7 @@ + + USE_OPENSSL=NO + OPENSSL=NONE ++WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -345,6 +346,7 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + ++ --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -563,6 +565,7 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + ++ --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +diff -ur nginx-1.12.2/src/event/ngx_event_openssl.c nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c +--- nginx-1.12.2/src/event/ngx_event_openssl.c 2017-10-17 23:16:38.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 11:13:34.994958124 +1000 +@@ -340,6 +340,10 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + ++#ifdef WOLFSSL_NGINX ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); ++#endif ++ + return NGX_OK; + } + +@@ -648,6 +652,14 @@ + + + ngx_int_t ++ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) ++{ ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); ++ ++ return NGX_OK; ++} ++ ++ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +@@ -1082,7 +1094,7 @@ + * maximum interoperability. + */ + +-#ifdef SSL_CTRL_SET_CURVES_LIST ++#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3050,7 +3062,8 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3094,7 +3107,8 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +diff -ur nginx-1.12.2/src/event/ngx_event_openssl.h nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h +--- nginx-1.12.2/src/event/ngx_event_openssl.h 2017-10-17 23:16:38.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 11:13:34.994958124 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -147,6 +150,7 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); ++ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.12.2/src/event/ngx_event_openssl_stapling.c nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c +--- nginx-1.12.2/src/event/ngx_event_openssl_stapling.c 2017-10-17 23:16:38.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 11:13:34.994958124 +1000 +@@ -313,7 +313,9 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#if OPENSSL_VERSION_NUMBER >= 0x10100001L ++#ifdef WOLFSSL_NGINX ++ issuer = X509_dup(issuer); ++#elif OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.12.2/src/http/modules/ngx_http_proxy_module.c nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.12.2/src/http/modules/ngx_http_proxy_module.c 2017-10-17 23:16:38.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 11:13:34.994958124 +1000 +@@ -4371,6 +4371,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); ++ + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.12.2/src/http/modules/ngx_http_ssl_module.c nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.12.2/src/http/modules/ngx_http_ssl_module.c 2017-10-17 23:16:38.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 11:13:34.994958124 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.12.2/src/mail/ngx_mail_ssl_module.c nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c +--- nginx-1.12.2/src/mail/ngx_mail_ssl_module.c 2017-10-17 23:16:38.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 11:13:34.998958139 +1000 +@@ -10,7 +10,11 @@ + #include + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.12.2/src/stream/ngx_stream_proxy_module.c nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c +--- nginx-1.12.2/src/stream/ngx_stream_proxy_module.c 2017-10-17 23:16:39.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 11:13:34.998958139 +1000 +@@ -2005,6 +2005,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, pscf->ssl); ++ + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.12.2/src/stream/ngx_stream_ssl_module.c nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c +--- nginx-1.12.2/src/stream/ngx_stream_ssl_module.c 2017-10-17 23:16:39.000000000 +1000 ++++ nginx-1.12.2-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 11:13:34.998958139 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/nginx-1.13.0-wolfssl-debug.patch b/nginx-1.13.0-wolfssl-debug.patch new file mode 100644 index 0000000..ba00a0f --- /dev/null +++ b/nginx-1.13.0-wolfssl-debug.patch @@ -0,0 +1,208 @@ +diff -ur nginx-1.13.0-wolfssl/auto/lib/openssl/conf nginx-1.13.0-wolfssl-debug/auto/lib/openssl/conf +--- nginx-1.13.0-wolfssl/auto/lib/openssl/conf 2018-02-01 08:37:32.565863658 +1000 ++++ nginx-1.13.0-wolfssl-debug/auto/lib/openssl/conf 2018-02-01 08:36:08.797416011 +1000 +@@ -61,33 +61,8 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" +- +- if [ $WOLFSSL != NONE ]; then +- ngx_feature="wolfSSL library in $WOLFSSL" +- ngx_feature_path="$WOLFSSL/include/wolfssl" +- +- if [ $NGX_RPATH = YES ]; then +- ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" +- else +- ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" +- fi +- +- CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" +- CFLAGS="$CFLAGS -DWOLFSSL_NGINX" +- fi +- + . auto/feature + +- if [ $WOLFSSL != NONE -a $ngx_found = no ]; then +-cat << END +- +-$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. +-SSL modules require the wolfSSL library. +- +-END +- exit 1 +- fi +- + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.13.0-wolfssl/auto/options nginx-1.13.0-wolfssl-debug/auto/options +--- nginx-1.13.0-wolfssl/auto/options 2018-02-01 08:37:32.565863658 +1000 ++++ nginx-1.13.0-wolfssl-debug/auto/options 2018-02-01 08:36:08.797416011 +1000 +@@ -143,7 +143,6 @@ + + USE_OPENSSL=NO + OPENSSL=NONE +-WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -346,7 +345,6 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + +- --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -565,7 +563,6 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + +- --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +diff -ur nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.c +--- nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 08:42:59.243534258 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-01 08:41:43.047153153 +1000 +@@ -144,6 +144,11 @@ + + #endif + ++#ifdef WOLFSSL_NGINX ++ /* Turn on internal wolfssl debugging to stdout */ ++ wolfSSL_Debugging_ON(); ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x0090800fL + #ifndef SSL_OP_NO_COMPRESSION + { +@@ -346,10 +351,6 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + +-#ifdef WOLFSSL_NGINX +- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); +-#endif +- + return NGX_OK; + } + +@@ -658,14 +659,6 @@ + + + ngx_int_t +-ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) +-{ +- SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); +- +- return NGX_OK; +-} +- +-ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +diff -ur nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.h +--- nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h 2018-02-01 08:42:38.107428966 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl.h 2018-02-01 08:40:01.334637114 +1000 +@@ -57,7 +57,7 @@ + #define ngx_ssl_conn_t SSL + + +-#if (OPENSSL_VERSION_NUMBER < 0x10002000L) && !defined(WOLFSSL_NGINX) ++#if (OPENSSL_VERSION_NUMBER < 0x10002000L) + #define SSL_is_server(s) (s)->server + #endif + +@@ -156,7 +156,6 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); +-ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl_stapling.c +--- nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-01 08:37:32.569863679 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/event/ngx_event_openssl_stapling.c 2018-02-01 08:36:08.805416054 +1000 +@@ -313,9 +313,7 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#ifdef WOLFSSL_NGINX +- issuer = X509_dup(issuer); +-#elif OPENSSL_VERSION_NUMBER >= 0x10100001L ++#if OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-01 08:37:32.569863679 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_proxy_module.c 2018-02-01 08:36:08.805416054 +1000 +@@ -4372,8 +4372,6 @@ + return NGX_ERROR; + } + +- ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); +- + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-01 08:37:32.569863679 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/http/modules/ngx_http_ssl_module.c 2018-02-01 08:36:08.809416074 +1000 +@@ -14,11 +14,7 @@ + ngx_pool_t *pool, ngx_str_t *s); + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c nginx-1.13.0-wolfssl-debug/src/mail/ngx_mail_ssl_module.c +--- nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-01 08:37:32.569863679 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/mail/ngx_mail_ssl_module.c 2018-02-01 08:36:08.813416096 +1000 +@@ -10,11 +10,7 @@ + #include + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_proxy_module.c +--- nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-01 08:37:32.569863679 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_proxy_module.c 2018-02-01 08:36:08.813416096 +1000 +@@ -2002,8 +2002,6 @@ + return NGX_ERROR; + } + +- ngx_ssl_set_verify_on(cf, pscf->ssl); +- + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_ssl_module.c +--- nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-01 08:37:32.569863679 +1000 ++++ nginx-1.13.0-wolfssl-debug/src/stream/ngx_stream_ssl_module.c 2018-02-01 08:36:08.813416096 +1000 +@@ -14,11 +14,7 @@ + ngx_pool_t *pool, ngx_str_t *s); + + +-#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" +-#else +-#define NGX_DEFAULT_CIPHERS "ALL" +-#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/nginx-1.13.0-wolfssl.patch b/nginx-1.13.0-wolfssl.patch new file mode 100644 index 0000000..4d3432d --- /dev/null +++ b/nginx-1.13.0-wolfssl.patch @@ -0,0 +1,216 @@ +diff -ur nginx-1.13.0/auto/lib/openssl/conf nginx-1.13.0-wolfssl/auto/lib/openssl/conf +--- nginx-1.13.0/auto/lib/openssl/conf 2017-04-26 00:18:22.000000000 +1000 ++++ nginx-1.13.0-wolfssl/auto/lib/openssl/conf 2018-02-01 08:37:32.565863658 +1000 +@@ -61,8 +61,33 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" ++ ++ if [ $WOLFSSL != NONE ]; then ++ ngx_feature="wolfSSL library in $WOLFSSL" ++ ngx_feature_path="$WOLFSSL/include/wolfssl" ++ ++ if [ $NGX_RPATH = YES ]; then ++ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ else ++ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ fi ++ ++ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" ++ CFLAGS="$CFLAGS -DWOLFSSL_NGINX" ++ fi ++ + . auto/feature + ++ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then ++cat << END ++ ++$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. ++SSL modules require the wolfSSL library. ++ ++END ++ exit 1 ++ fi ++ + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.13.0/auto/options nginx-1.13.0-wolfssl/auto/options +--- nginx-1.13.0/auto/options 2017-04-26 00:18:22.000000000 +1000 ++++ nginx-1.13.0-wolfssl/auto/options 2018-02-01 08:37:32.565863658 +1000 +@@ -143,6 +143,7 @@ + + USE_OPENSSL=NO + OPENSSL=NONE ++WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -345,6 +346,7 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + ++ --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -563,6 +565,7 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + ++ --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +diff -ur nginx-1.13.0/src/event/ngx_event_openssl.c nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c +--- nginx-1.13.0/src/event/ngx_event_openssl.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 08:42:59.243534258 +1000 +@@ -346,6 +346,10 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + ++#ifdef WOLFSSL_NGINX ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); ++#endif ++ + return NGX_OK; + } + +@@ -654,6 +658,14 @@ + + + ngx_int_t ++ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) ++{ ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); ++ ++ return NGX_OK; ++} ++ ++ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +@@ -1090,7 +1102,8 @@ + * maximum interoperability. + */ + +-#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) ++#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) || \ ++ defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +diff -ur nginx-1.13.0/src/event/ngx_event_openssl.h nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h +--- nginx-1.13.0/src/event/ngx_event_openssl.h 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/event/ngx_event_openssl.h 2018-02-01 08:42:38.107428966 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -54,7 +57,7 @@ + #define ngx_ssl_conn_t SSL + + +-#if (OPENSSL_VERSION_NUMBER < 0x10002000L) ++#if (OPENSSL_VERSION_NUMBER < 0x10002000L) && !defined(WOLFSSL_NGINX) + #define SSL_is_server(s) (s)->server + #endif + +@@ -153,6 +156,7 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); ++ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.13.0/src/event/ngx_event_openssl_stapling.c nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c +--- nginx-1.13.0/src/event/ngx_event_openssl_stapling.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-01 08:37:32.569863679 +1000 +@@ -313,7 +313,9 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#if OPENSSL_VERSION_NUMBER >= 0x10100001L ++#ifdef WOLFSSL_NGINX ++ issuer = X509_dup(issuer); ++#elif OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.13.0/src/http/modules/ngx_http_proxy_module.c nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.13.0/src/http/modules/ngx_http_proxy_module.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-01 08:37:32.569863679 +1000 +@@ -4372,6 +4372,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); ++ + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.13.0/src/http/modules/ngx_http_ssl_module.c nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.13.0/src/http/modules/ngx_http_ssl_module.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-01 08:37:32.569863679 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.13.0/src/mail/ngx_mail_ssl_module.c nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c +--- nginx-1.13.0/src/mail/ngx_mail_ssl_module.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-01 08:37:32.569863679 +1000 +@@ -10,7 +10,11 @@ + #include + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.13.0/src/stream/ngx_stream_proxy_module.c nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c +--- nginx-1.13.0/src/stream/ngx_stream_proxy_module.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-01 08:37:32.569863679 +1000 +@@ -2002,6 +2002,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, pscf->ssl); ++ + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.13.0/src/stream/ngx_stream_ssl_module.c nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c +--- nginx-1.13.0/src/stream/ngx_stream_ssl_module.c 2017-04-26 00:18:23.000000000 +1000 ++++ nginx-1.13.0-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-01 08:37:32.569863679 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/nginx-1.13.2-wolfssl-debug.patch b/nginx-1.13.2-wolfssl-debug.patch index 5e444c4..51d7cdc 100644 --- a/nginx-1.13.2-wolfssl-debug.patch +++ b/nginx-1.13.2-wolfssl-debug.patch @@ -1,6 +1,6 @@ diff -ur nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c nginx-1.13.2-wolfssl-debug/src/event/ngx_event_openssl.c ---- nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2017-06-29 10:18:05.421755825 +1000 -+++ nginx-1.13.2-wolfssl-debug/src/event/ngx_event_openssl.c 2017-06-29 10:46:26.172278923 +1000 +--- nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 09:02:23.968175319 +1000 ++++ nginx-1.13.2-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-01 09:07:08.597382683 +1000 @@ -144,6 +144,11 @@ #endif diff --git a/nginx-1.13.2-wolfssl.patch b/nginx-1.13.2-wolfssl.patch index be6e55e..7a136b6 100644 --- a/nginx-1.13.2-wolfssl.patch +++ b/nginx-1.13.2-wolfssl.patch @@ -64,7 +64,7 @@ diff -ur nginx-1.13.2/auto/options nginx-1.13.2-wolfssl/auto/options diff -ur nginx-1.13.2/src/event/ngx_event_openssl.c nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c --- nginx-1.13.2/src/event/ngx_event_openssl.c 2017-06-28 00:44:20.000000000 +1000 -+++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2017-06-29 10:18:05.421755825 +1000 ++++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.c 2018-02-01 09:02:23.968175319 +1000 @@ -346,6 +346,10 @@ SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); @@ -91,11 +91,30 @@ diff -ur nginx-1.13.2/src/event/ngx_event_openssl.c nginx-1.13.2-wolfssl/src/eve ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, ngx_int_t depth) { -Only in nginx-1.13.2-wolfssl/src/event: .ngx_event_openssl.c.swp +@@ -1090,7 +1102,8 @@ + * maximum interoperability. + */ + +-#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) ++#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) || \ ++ defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single diff -ur nginx-1.13.2/src/event/ngx_event_openssl.h nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.h --- nginx-1.13.2/src/event/ngx_event_openssl.h 2017-06-28 00:44:20.000000000 +1000 -+++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.h 2017-06-29 10:33:37.484896533 +1000 -@@ -54,7 +54,7 @@ ++++ nginx-1.13.2-wolfssl/src/event/ngx_event_openssl.h 2018-02-01 09:02:00.048075409 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -54,7 +57,7 @@ #define ngx_ssl_conn_t SSL @@ -104,7 +123,7 @@ diff -ur nginx-1.13.2/src/event/ngx_event_openssl.h nginx-1.13.2-wolfssl/src/eve #define SSL_is_server(s) (s)->server #endif -@@ -153,6 +153,7 @@ +@@ -153,6 +156,7 @@ ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, ngx_uint_t prefer_server_ciphers); diff --git a/nginx-1.13.8-wolfssl-debug.patch b/nginx-1.13.8-wolfssl-debug.patch new file mode 100644 index 0000000..9ed1708 --- /dev/null +++ b/nginx-1.13.8-wolfssl-debug.patch @@ -0,0 +1,15 @@ +diff -ur nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c nginx-1.13.8-wolfssl-debug/src/event/ngx_event_openssl.c +--- nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 10:10:29.701973701 +1000 ++++ nginx-1.13.8-wolfssl-debug/src/event/ngx_event_openssl.c 2018-02-02 10:34:24.287926076 +1000 +@@ -144,6 +144,11 @@ + + #endif + ++#ifdef WOLFSSL_NGINX ++ /* Turn on internal wolfssl debugging to stdout */ ++ wolfSSL_Debugging_ON(); ++#endif ++ + #if OPENSSL_VERSION_NUMBER >= 0x0090800fL + #ifndef SSL_OP_NO_COMPRESSION + { diff --git a/nginx-1.13.8-wolfssl.patch b/nginx-1.13.8-wolfssl.patch new file mode 100644 index 0000000..cb82d21 --- /dev/null +++ b/nginx-1.13.8-wolfssl.patch @@ -0,0 +1,237 @@ +diff -ur nginx-1.13.8/auto/lib/openssl/conf nginx-1.13.8-wolfssl/auto/lib/openssl/conf +--- nginx-1.13.8/auto/lib/openssl/conf 2017-12-27 02:01:12.000000000 +1000 ++++ nginx-1.13.8-wolfssl/auto/lib/openssl/conf 2018-02-02 08:42:39.490622923 +1000 +@@ -61,8 +61,33 @@ + ngx_feature_path= + ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL" + ngx_feature_test="SSL_CTX_set_options(NULL, 0)" ++ ++ if [ $WOLFSSL != NONE ]; then ++ ngx_feature="wolfSSL library in $WOLFSSL" ++ ngx_feature_path="$WOLFSSL/include/wolfssl" ++ ++ if [ $NGX_RPATH = YES ]; then ++ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ else ++ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl $NGX_LIBDL" ++ fi ++ ++ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl" ++ CFLAGS="$CFLAGS -DWOLFSSL_NGINX" ++ fi ++ + . auto/feature + ++ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then ++cat << END ++ ++$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl. ++SSL modules require the wolfSSL library. ++ ++END ++ exit 1 ++ fi ++ + if [ $ngx_found = no ]; then + + # FreeBSD port +diff -ur nginx-1.13.8/auto/options nginx-1.13.8-wolfssl/auto/options +--- nginx-1.13.8/auto/options 2017-12-27 02:01:12.000000000 +1000 ++++ nginx-1.13.8-wolfssl/auto/options 2018-02-02 08:42:39.490622923 +1000 +@@ -144,6 +144,7 @@ + + USE_OPENSSL=NO + OPENSSL=NONE ++WOLFSSL=NONE + + USE_ZLIB=NO + ZLIB=NONE +@@ -347,6 +348,7 @@ + --with-pcre-opt=*) PCRE_OPT="$value" ;; + --with-pcre-jit) PCRE_JIT=YES ;; + ++ --with-wolfssl=*) WOLFSSL="$value" ;; + --with-openssl=*) OPENSSL="$value" ;; + --with-openssl-opt=*) OPENSSL_OPT="$value" ;; + +@@ -566,6 +568,7 @@ + --with-libatomic force libatomic_ops library usage + --with-libatomic=DIR set path to libatomic_ops library sources + ++ --with-wolfssl=DIR set path to wolfSSL headers and library + --with-openssl=DIR set path to OpenSSL library sources + --with-openssl-opt=OPTIONS set additional build options for OpenSSL + +Only in nginx-1.13.8-wolfssl: conf.rej +diff -ur nginx-1.13.8/src/event/ngx_event_openssl.c nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c +--- nginx-1.13.8/src/event/ngx_event_openssl.c 2017-12-27 02:01:12.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 10:10:29.701973701 +1000 +@@ -346,6 +346,10 @@ + + SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback); + ++#ifdef WOLFSSL_NGINX ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL); ++#endif ++ + return NGX_OK; + } + +@@ -654,6 +658,14 @@ + + + ngx_int_t ++ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl) ++{ ++ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback); ++ ++ return NGX_OK; ++} ++ ++ngx_int_t + ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert, + ngx_int_t depth) + { +@@ -1091,7 +1103,8 @@ + * maximum interoperability. + */ + +-#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) ++#if (defined SSL_CTX_set1_curves_list || defined SSL_CTRL_SET_CURVES_LIST) || \ ++ defined(WOLFSSL_NGINX) + + /* + * OpenSSL 1.0.2+ allows configuring a curve list instead of a single +@@ -3061,7 +3074,8 @@ + return -1; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[0].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +@@ -3105,7 +3119,8 @@ + size = 32; + } + +-#if OPENSSL_VERSION_NUMBER >= 0x10000000L ++#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \ ++ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS)) + if (HMAC_Init_ex(hctx, key[i].hmac_key, size, digest, NULL) != 1) { + ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed"); + return -1; +diff -ur nginx-1.13.8/src/event/ngx_event_openssl.h nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.h +--- nginx-1.13.8/src/event/ngx_event_openssl.h 2017-12-27 02:01:12.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 08:42:39.494622923 +1000 +@@ -12,6 +12,9 @@ + #include + #include + ++#ifdef WOLFSSL_NGINX ++#include ++#endif + #include + #include + #include +@@ -55,7 +58,7 @@ + #define ngx_ssl_conn_t SSL + + +-#if (OPENSSL_VERSION_NUMBER < 0x10002000L) ++#if (OPENSSL_VERSION_NUMBER < 0x10002000L) && !defined(WOLFSSL_NGINX) + #define SSL_is_server(s) (s)->server + #endif + +@@ -154,6 +157,7 @@ + ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords); + ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers, + ngx_uint_t prefer_server_ciphers); ++ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl); + ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, + ngx_str_t *cert, ngx_int_t depth); + ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, +diff -ur nginx-1.13.8/src/event/ngx_event_openssl_stapling.c nginx-1.13.8-wolfssl/src/event/ngx_event_openssl_stapling.c +--- nginx-1.13.8/src/event/ngx_event_openssl_stapling.c 2017-12-27 02:01:12.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/event/ngx_event_openssl_stapling.c 2018-02-02 08:42:39.494622923 +1000 +@@ -313,7 +313,9 @@ + for (i = 0; i < n; i++) { + issuer = sk_X509_value(chain, i); + if (X509_check_issued(issuer, cert) == X509_V_OK) { +-#if OPENSSL_VERSION_NUMBER >= 0x10100001L ++#ifdef WOLFSSL_NGINX ++ issuer = X509_dup(issuer); ++#elif OPENSSL_VERSION_NUMBER >= 0x10100001L + X509_up_ref(issuer); + #else + CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509); +diff -ur nginx-1.13.8/src/http/modules/ngx_http_proxy_module.c nginx-1.13.8-wolfssl/src/http/modules/ngx_http_proxy_module.c +--- nginx-1.13.8/src/http/modules/ngx_http_proxy_module.c 2017-12-27 02:01:13.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/http/modules/ngx_http_proxy_module.c 2018-02-02 08:42:39.494622923 +1000 +@@ -4324,6 +4324,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl); ++ + if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl, + &plcf->ssl_trusted_certificate, + plcf->ssl_verify_depth) +diff -ur nginx-1.13.8/src/http/modules/ngx_http_ssl_module.c nginx-1.13.8-wolfssl/src/http/modules/ngx_http_ssl_module.c +--- nginx-1.13.8/src/http/modules/ngx_http_ssl_module.c 2017-12-27 02:01:13.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/http/modules/ngx_http_ssl_module.c 2018-02-02 08:42:39.494622923 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + #define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1" +diff -ur nginx-1.13.8/src/mail/ngx_mail_ssl_module.c nginx-1.13.8-wolfssl/src/mail/ngx_mail_ssl_module.c +--- nginx-1.13.8/src/mail/ngx_mail_ssl_module.c 2017-12-27 02:01:13.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/mail/ngx_mail_ssl_module.c 2018-02-02 08:42:39.494622923 +1000 +@@ -10,7 +10,11 @@ + #include + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + +diff -ur nginx-1.13.8/src/stream/ngx_stream_proxy_module.c nginx-1.13.8-wolfssl/src/stream/ngx_stream_proxy_module.c +--- nginx-1.13.8/src/stream/ngx_stream_proxy_module.c 2017-12-27 02:01:13.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/stream/ngx_stream_proxy_module.c 2018-02-02 08:42:39.494622923 +1000 +@@ -2003,6 +2003,8 @@ + return NGX_ERROR; + } + ++ ngx_ssl_set_verify_on(cf, pscf->ssl); ++ + if (ngx_ssl_trusted_certificate(cf, pscf->ssl, + &pscf->ssl_trusted_certificate, + pscf->ssl_verify_depth) +diff -ur nginx-1.13.8/src/stream/ngx_stream_ssl_module.c nginx-1.13.8-wolfssl/src/stream/ngx_stream_ssl_module.c +--- nginx-1.13.8/src/stream/ngx_stream_ssl_module.c 2017-12-27 02:01:13.000000000 +1000 ++++ nginx-1.13.8-wolfssl/src/stream/ngx_stream_ssl_module.c 2018-02-02 08:42:39.494622923 +1000 +@@ -14,7 +14,11 @@ + ngx_pool_t *pool, ngx_str_t *s); + + ++#ifndef WOLFSSL_NGINX + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" ++#else ++#define NGX_DEFAULT_CIPHERS "ALL" ++#endif + #define NGX_DEFAULT_ECDH_CURVE "auto" + + diff --git a/test.sh b/test.sh index f5bc1b3..2f25382 100755 --- a/test.sh +++ b/test.sh @@ -1,5 +1,7 @@ #!/bin/bash + + NGINX_SRC="../nginx" if [ "$NGINX_BIN" = "" ]; then NGINX_BIN="${NGINX_SRC}/objs/nginx" @@ -10,6 +12,7 @@ fi WOLFSSL_CLIENT="./examples/client/client" WOLFSSL_OCSP_CERTS="${WOLFSSL_SOURCE}/certs/ocsp" NGINX_CONF="./conf/nginx.conf" +NGINX_TLS13_CONF="./conf/nginx_tls13.conf" CLIENT_TMP="/tmp/nginx_client.$$" SERVER_TMP="/tmp/nginx_server.$$" OCSP_GOOD="ocsp-good-status.der" @@ -25,6 +28,22 @@ if [ "$IPV6" != "" ]; then fi +while [ $# -gt 0 ] +do + case $1 in + -tls13) + TLS13=1 + NGINX_CONF=$NGINX_TLS13_CONF + ;; + *) + echo "Unrecognized option: $1" + exit 1 + ;; + esac + shift +done + + if [ ! -f $NGINX_BIN ]; then echo "Could not find Nginx exe: ${NGINX_BIN}" echo "Stopping - FAIL" @@ -235,19 +254,21 @@ echo '# ECC Certificate, ECDH Key Exchange: default curve (prime256v1)' echo '#' PORT=11446 echo "# Port: $PORT" -OPTS= +OPTS="-A certs/ca-ecc-cert.pem" EXPECT=("SECP256R1" "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" "HTTP/1.1 200 OK") client_test -# TLS v1.3 -echo -echo '#' -echo '# TLS v1.3 client connecting to nginx server' -echo '#' -PORT=11447 -echo "# Port: $PORT" -OPTS="-v 4" -EXPECT=("SECP256R1" "TLS_AES_128_GCM_SHA256" "HTTP/1.1 200 OK") -client_test +if [ "$TLS13" != "" ]; then + # TLS v1.3 + echo + echo '#' + echo '# TLS v1.3 client connecting to nginx server' + echo '#' + PORT=11447 + echo "# Port: $PORT" + OPTS="-v 4" + EXPECT=("SECP256R1" "TLS_AES_128_GCM_SHA256" "HTTP/1.1 200 OK") + client_test +fi # Session tickets file echo echo '#' @@ -284,7 +305,11 @@ echo '#' PORT=11457 echo "# Port: $PORT" OPTS= -EXPECT=("reused session id" "HTTP/1.1 200 OK") +if [ "$TLS13" != "" ]; then + EXPECT=("HTTP/1.1 200 OK") +else + EXPECT=("reused session id" "HTTP/1.1 200 OK") +fi client_test # Proxy to localhost:11111 - DHE-RSA