Add OpenResty 1.31.1.1 port and tests patch - #363
Open
julek-wolfssl wants to merge 1 commit into
Open
julek-wolfssl wants to merge 1 commit into
julek-wolfssl wants to merge 1 commit into
Conversation
1.31.1.1.patch: the nginx part is nginx-1.28.1-wolfssl.patch rebased onto the bundled nginx 1.31.1, plus guards for SSL_AD_REASON_OFFSET, the sixth SSL_CTX ex_data index and nginx's ASN1_STRING_get0_data fallback. The bundled lua-resty-core falls back to wolfSSL_session_reused(). ngx_stream_lua 0.0.19rc4 initialises its lua_ssl_* defaults only under HAVE_LUA_PROXY_SSL (OpenSSL 3.0.2 and newer); initialise them whenever the stream SSL module is built, otherwise nginx rejects lua_ssl_verify_depth as a duplicate directive. wolfSSL's certificate callback cannot suspend the handshake, so when ssl_certificate_by_lua* yields, ngx_lua and ngx_stream_lua now log it at [crit] and fail the handshake instead of returning -1, which left nginx spinning (TLS 1.3) or failing with a buffer error (TLS 1.2). 1.31.1.1-tests.patch, applied after the port patch: makes the Test::Nginx SSL suites of ngx_lua, ngx_stream_lua and lua-resty-core run against a wolfSSL build. It recognises "built with wolfSSL" in the nginx -V banner, skips the files that need APIs wolfSSL does not provide (ssl_client_hello_by_lua*, proxy_ssl_*_by_lua*, FFI into libcrypto), skips the blocks that check OpenSSL-specific log text, alert names, cipher descriptions or OpenSSL 1.1.1a APIs, or that yield inside ssl_certificate_by_lua*, each with the reason in the block, and expects the Server header the OpenResty bundle sends. wolfSSL's .github/workflows/openresty.yml runs these files in CI. README: build and test instructions, known limitations. Verified with wolfSSL master (--enable-openresty): default and --with-debug builds are warning free; nginx-tests (wolfSSL CI lists) match the OpenSSL build of the same tree; the curated test files pass three times in a row with wolfSSL and, apart from two blocks that fail in this environment with OpenSSL too, once with the OpenSSL build.
There was a problem hiding this comment.
🟡 Changes recommended
The patch has unresolved certificate-chain handling and overly permissive default cipher configuration issues.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds OpenResty 1.31.1.1 wolfSSL support, adapted SSL tests, and documentation.
Changes:
- Adds the OpenResty/wolfSSL integration patch.
- Adapts SSL tests for wolfSSL compatibility.
- Updates build, limitation, and module documentation.
File summaries
| File | Description |
|---|---|
README.md |
Updates the OpenResty documentation link. |
openresty/README.md |
Documents build, testing, and limitations. |
openresty/modules/encrypted-session-nginx-module/README.md |
Documents module compatibility. |
openresty/1.31.1.1.patch |
Adds wolfSSL integration and Lua SSL changes. |
openresty/1.31.1.1-tests.patch |
Adapts bundled SSL tests for wolfSSL. |
Review details
Suppressed comments (2)
openresty/1.31.1.1.patch:358
- The mail module gets the same insecure default-cipher broadening from
HIGH:!aNULL:!MD5toALL. A mail service using the module's defaults can therefore enable weak or unauthenticated suites when compiled into wolfSSL; keep the default restrictive or require an explicit cipher policy.
++#define NGX_DEFAULT_CIPHERS "ALL"
openresty/1.31.1.1.patch:374
- The stream module gets the same insecure default-cipher broadening from
HIGH:!aNULL:!MD5toALL. A stream service using the module's defaults can therefore enable weak or unauthenticated suites when compiled into wolfSSL; keep the default restrictive or require an explicit cipher policy.
++#define NGX_DEFAULT_CIPHERS "ALL"
- Files reviewed: 5/5 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| ++#ifndef WOLFSSL_NGINX | ||
| + #define NGX_DEFAULT_CIPHERS "HIGH:!aNULL:!MD5" | ||
| ++#else | ||
| ++#define NGX_DEFAULT_CIPHERS "ALL" |
| ++#ifdef WOLFSSL_NGINX | ||
| ++ { | ||
| ++ int i; | ||
| ++ for (i = sk_X509_num(chain) - 1; i > 0; i--) { |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.31.1.1.patch: rebases nginx-1.28.1-wolfssl.patch onto bundled nginx 1.31.1, adding guards forSSL_AD_REASON_OFFSET, the sixthSSL_CTXex_data index, and nginx'sASN1_STRING_get0_datafallback. Bundled lua-resty-core falls back towolfSSL_session_reused(). Fixesngx_stream_lua0.0.19rc4 so it initialiseslua_ssl_*defaults whenever the stream SSL module is built, not only underHAVE_LUA_PROXY_SSL, avoiding a duplicatelua_ssl_verify_depthdirective rejection. Since wolfSSL's certificate callback cannot suspend the handshake,ngx_luaandngx_stream_luanow log at[crit]and fail the handshake instead of returning-1whenssl_certificate_by_lua*yields, which previously caused spinning (TLS 1.3) or a buffer error (TLS 1.2).1.31.1.1-tests.patch(applied after the port patch): adapts the Test::Nginx SSL suites ofngx_lua,ngx_stream_luaandlua-resty-coreto run against a wolfSSL build — recognizes "built with wolfSSL" in thenginx -Vbanner, skips tests needing APIs wolfSSL lacks (ssl_client_hello_by_lua*,proxy_ssl_*_by_lua*, libcrypto FFI), skips OpenSSL-specific log/alert/cipher checks and OpenSSL 1.1.1a-only APIs, skips yield-inside-ssl_certificate_by_lua*blocks, and expects the OpenResty bundle's Server header. These files are run by wolfSSL's.github/workflows/openresty.ymlCI.--enable-openresty): default and--with-debugbuilds are warning free, nginx-tests match the OpenSSL build of the same tree, and the curated test files pass three times in a row with wolfSSL (apart from two blocks that also fail with OpenSSL in this environment).