WolfSSL
/
wolfssl-nginx
mirror of https://github.com/wolfSSL/wolfssl-nginx.git
1
0
Fork 0
Code Issues Releases Wiki Activity
wolfssl-nginx/nginx-1.11.7-wolfssl.patch

244 lines
9.3 KiB
Diff
Raw Blame History

diff -ur nginx-1.11.7/auto/lib/openssl/conf nginx-1.11.7-wolfssl/auto/lib/openssl/conf
--- nginx-1.11.7/auto/lib/openssl/conf 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/auto/lib/openssl/conf 2018-03-15 10:41:46.330586503 +1000
@@ -15,8 +15,16 @@
CORE_INCS="$CORE_INCS $OPENSSL/openssl/include"
CORE_DEPS="$CORE_DEPS $OPENSSL/openssl/include/openssl/ssl.h"
- CORE_LIBS="$CORE_LIBS $OPENSSL/openssl/lib/ssleay32.lib"
- CORE_LIBS="$CORE_LIBS $OPENSSL/openssl/lib/libeay32.lib"
+
+ if [ -f $OPENSSL/ms/do_ms.bat ]; then
+ # before OpenSSL 1.1.0
+ CORE_LIBS="$CORE_LIBS $OPENSSL/openssl/lib/ssleay32.lib"
+ CORE_LIBS="$CORE_LIBS $OPENSSL/openssl/lib/libeay32.lib"
+ else
+ # OpenSSL 1.1.0+
+ CORE_LIBS="$CORE_LIBS $OPENSSL/openssl/lib/libssl.lib"
+ CORE_LIBS="$CORE_LIBS $OPENSSL/openssl/lib/libcrypto.lib"
+ fi
# libeay32.lib requires gdi32.lib
CORE_LIBS="$CORE_LIBS gdi32.lib"
@@ -49,12 +57,38 @@
ngx_feature="OpenSSL library"
ngx_feature_name="NGX_OPENSSL"
ngx_feature_run=no
- ngx_feature_incs="#include <openssl/ssl.h>"
+ ngx_feature_incs="#include <options.h>
+ #include <openssl/ssl.h>"
ngx_feature_path=
ngx_feature_libs="-lssl -lcrypto $NGX_LIBDL"
ngx_feature_test="SSL_CTX_set_options(NULL, 0)"
+
+ if [ $WOLFSSL != NONE ]; then
+ ngx_feature="wolfSSL library in $WOLFSSL"
+ ngx_feature_path="$WOLFSSL/include/wolfssl $WOLFSSL/include"
+
+ if [ $NGX_RPATH = YES ]; then
+ ngx_feature_libs="-R$WOLFSSL/lib -L$WOLFSSL/lib -lwolfssl -lm $NGX_LIBDL"
+ else
+ ngx_feature_libs="-L$WOLFSSL/lib -lwolfssl -lm $NGX_LIBDL"
+ fi
+
+ CORE_INCS="$CORE_INCS $WOLFSSL/include/wolfssl"
+ CFLAGS="$CFLAGS -DWOLFSSL_NGINX"
+ fi
+
. auto/feature
+ if [ $WOLFSSL != NONE -a $ngx_found = no ]; then
+cat << END
+
+$0: error: Could not find wolfSSL at $WOLFSSL/include/wolfssl.
+SSL modules require the wolfSSL library.
+
+END
+ exit 1
+ fi
+
if [ $ngx_found = no ]; then
# FreeBSD port
diff -ur nginx-1.11.7/auto/options nginx-1.11.7-wolfssl/auto/options
--- nginx-1.11.7/auto/options 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/auto/options 2017-01-17 16:09:53.864946344 +1000
@@ -141,6 +141,7 @@
PCRE_CONF_OPT=
PCRE_JIT=NO
+WOLFSSL=NONE
USE_OPENSSL=NO
OPENSSL=NONE
@@ -345,6 +346,7 @@
--with-pcre-opt=*) PCRE_OPT="$value" ;;
--with-pcre-jit) PCRE_JIT=YES ;;
+ --with-wolfssl=*) WOLFSSL="$value" ;;
--with-openssl=*) OPENSSL="$value" ;;
--with-openssl-opt=*) OPENSSL_OPT="$value" ;;
diff -ur nginx-1.11.7/src/event/ngx_event_openssl.c nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c
--- nginx-1.11.7/src/event/ngx_event_openssl.c 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.c 2018-02-02 14:27:14.826866032 +1000
@@ -330,6 +330,10 @@
SSL_CTX_set_info_callback(ssl->ctx, ngx_ssl_info_callback);
+#ifdef WOLFSSL_NGINX
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_NONE, NULL);
+#endif
+
return NGX_OK;
}
@@ -638,6 +642,14 @@
ngx_int_t
+ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl)
+{
+ SSL_CTX_set_verify(ssl->ctx, SSL_VERIFY_PEER, ngx_ssl_verify_callback);
+
+ return NGX_OK;
+}
+
+ngx_int_t
ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *cert,
ngx_int_t depth)
{
@@ -1072,7 +1084,7 @@
* maximum interoperability.
*/
-#ifdef SSL_CTRL_SET_CURVES_LIST
+#if defined(SSL_CTRL_SET_CURVES_LIST) || defined(WOLFSSL_NGINX)
/*
* OpenSSL 1.0.2+ allows configuring a curve list instead of a single
@@ -3019,7 +3031,8 @@
return -1;
}
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[0].hmac_key, 16, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
@@ -3054,7 +3067,8 @@
ngx_hex_dump(buf, key[i].name, 16) - buf, buf,
(i == 0) ? " (default)" : "");
-#if OPENSSL_VERSION_NUMBER >= 0x10000000L
+#if OPENSSL_VERSION_NUMBER >= 0x10000000L && \
+ (!defined(WOLFSSL_NGINX) || !defined(HAVE_FIPS))
if (HMAC_Init_ex(hctx, key[i].hmac_key, 16, digest, NULL) != 1) {
ngx_ssl_error(NGX_LOG_ALERT, c->log, 0, "HMAC_Init_ex() failed");
return -1;
diff -ur nginx-1.11.7/src/event/ngx_event_openssl.h nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h
--- nginx-1.11.7/src/event/ngx_event_openssl.h 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl.h 2018-02-02 09:01:17.610518828 +1000
@@ -12,6 +12,9 @@
#include <ngx_config.h>
#include <ngx_core.h>
+#ifdef WOLFSSL_NGINX
+#include <wolfssl/options.h>
+#endif
#include <openssl/ssl.h>
#include <openssl/err.h>
#include <openssl/bn.h>
@@ -146,6 +149,7 @@
ngx_str_t *cert, ngx_str_t *key, ngx_array_t *passwords);
ngx_int_t ngx_ssl_ciphers(ngx_conf_t *cf, ngx_ssl_t *ssl, ngx_str_t *ciphers,
ngx_uint_t prefer_server_ciphers);
+ngx_int_t ngx_ssl_set_verify_on(ngx_conf_t *cf, ngx_ssl_t *ssl);
ngx_int_t ngx_ssl_client_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
ngx_str_t *cert, ngx_int_t depth);
ngx_int_t ngx_ssl_trusted_certificate(ngx_conf_t *cf, ngx_ssl_t *ssl,
diff -ur nginx-1.11.7/src/event/ngx_event_openssl_stapling.c nginx-1.11.7-wolfssl/src/event/ngx_event_openssl_stapling.c
--- nginx-1.11.7/src/event/ngx_event_openssl_stapling.c 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/event/ngx_event_openssl_stapling.c 2017-01-17 16:09:53.864946344 +1000
@@ -313,7 +313,9 @@
for (i = 0; i < n; i++) {
issuer = sk_X509_value(chain, i);
if (X509_check_issued(issuer, cert) == X509_V_OK) {
-#if OPENSSL_VERSION_NUMBER >= 0x10100001L
+#ifdef WOLFSSL_NGINX
+ issuer = X509_dup(issuer);
+#elif OPENSSL_VERSION_NUMBER >= 0x10100001L
X509_up_ref(issuer);
#else
CRYPTO_add(&issuer->references, 1, CRYPTO_LOCK_X509);
diff -ur nginx-1.11.7/src/http/modules/ngx_http_proxy_module.c nginx-1.11.7-wolfssl/src/http/modules/ngx_http_proxy_module.c
--- nginx-1.11.7/src/http/modules/ngx_http_proxy_module.c 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/http/modules/ngx_http_proxy_module.c 2017-04-13 14:48:59.546269024 +1000
@@ -4359,6 +4359,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, plcf->upstream.ssl);
+
if (ngx_ssl_trusted_certificate(cf, plcf->upstream.ssl,
&plcf->ssl_trusted_certificate,
plcf->ssl_verify_depth)
diff -ur nginx-1.11.7/src/http/modules/ngx_http_ssl_module.c nginx-1.11.7-wolfssl/src/http/modules/ngx_http_ssl_module.c
--- nginx-1.11.7/src/http/modules/ngx_http_ssl_module.c 2016-12-14 01:21:24.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/http/modules/ngx_http_ssl_module.c 2017-01-17 16:09:53.864946344 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
#define NGX_HTTP_NPN_ADVERTISE "\x08http/1.1"
diff -ur nginx-1.11.7/src/mail/ngx_mail_ssl_module.c nginx-1.11.7-wolfssl/src/mail/ngx_mail_ssl_module.c
--- nginx-1.11.7/src/mail/ngx_mail_ssl_module.c 2016-12-14 01:21:25.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/mail/ngx_mail_ssl_module.c 2017-01-17 16:09:53.864946344 +1000
@@ -10,7 +10,11 @@
#include <ngx_mail.h>
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
diff -ur nginx-1.11.7/src/stream/ngx_stream_proxy_module.c nginx-1.11.7-wolfssl/src/stream/ngx_stream_proxy_module.c
--- nginx-1.11.7/src/stream/ngx_stream_proxy_module.c 2016-12-14 01:21:25.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/stream/ngx_stream_proxy_module.c 2017-04-14 09:31:49.419667939 +1000
@@ -1995,6 +1995,8 @@
return NGX_ERROR;
}
+ ngx_ssl_set_verify_on(cf, pscf->ssl);
+
if (ngx_ssl_trusted_certificate(cf, pscf->ssl,
&pscf->ssl_trusted_certificate,
pscf->ssl_verify_depth)
diff -ur nginx-1.11.7/src/stream/ngx_stream_ssl_module.c nginx-1.11.7-wolfssl/src/stream/ngx_stream_ssl_module.c
--- nginx-1.11.7/src/stream/ngx_stream_ssl_module.c 2016-12-14 01:21:25.000000000 +1000
+++ nginx-1.11.7-wolfssl/src/stream/ngx_stream_ssl_module.c 2017-01-17 16:09:53.864946344 +1000
@@ -14,7 +14,11 @@
ngx_pool_t *pool, ngx_str_t *s);
+#ifndef WOLFSSL_NGINX
#define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5"
+#else
+#define NGX_DEFAULT_CIPHERS "ALL"
+#endif
#define NGX_DEFAULT_ECDH_CURVE "auto"
Reference in New Issue View Git Blame Copy Permalink