Add OpenResty 1.31.1.1 support and CI - #11498
Open
julek-wolfssl wants to merge 1 commit into
Open
julek-wolfssl wants to merge 1 commit into
julek-wolfssl wants to merge 1 commit into
Conversation
Fixes needed by the OSP OpenResty 1.31.1.1 port, plus a workflow that runs the bundled SSL tests against wolfSSL. d2i_X509_bio(): read one DER object per call, as OpenSSL does. ngx_lua's set_der_cert() decodes a chain from one BIO one certificate at a time. MAX_EX_DATA: default to 10 slots for --enable-nginx unless --enable-context-extra-user-data gives a number. nginx 1.31 allocates six SSL_CTX ex_data indexes and the OpenResty Lua modules use five SSL ones. wolfSSL_OCSP_resp_find_status() and wolfSSL_OCSP_single_get0_status(): return NULL for an absent thisUpdate or nextUpdate instead of a pointer to a zeroed WOLFSSL_ASN1_TIME. ngx.ocsp.validate_ocsp_response() failed with "invalid nextUpdate time" for responses without nextUpdate. Session cache: with WOLFSSL_TICKET_HAVE_ID, DoClientTicketFinalize() called the external cache callback on every ticket resumption because useTicket is only set after DoClientTicket() returns. Add wolfSSL_GetSessionFromInternalCache() and use it unless the server accepts early data (maxEarlyDataSz > 0), where the external cache takes part in the 0-RTT anti-replay eviction. OpenSSL does the same: stateful tickets and a cache lookup only with max_early_data set. ngx_lua expects ssl_session_fetch_by_lua* to be skipped for ticket resumptions. .github/workflows/openresty.yml: build OpenResty 1.31.1.1 with the OSP port and tests patches against --enable-openresty and run the SSL test files of ngx_lua, ngx_stream_lua and lua-resty-core, plus the encrypted-session and set-misc suites, with Test::Nginx. Files that need APIs wolfSSL does not provide or the network are not run. The OSP checkout points at julek-dev/osp openresty-1.31.1.1 until the patches are merged into wolfSSL/osp. memcached is a new test dependency. Tests: d2i_X509_bio chain decoding, absent OCSP times, session cache callback counts with tickets and early data.
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The nginx/OpenResty MAX_EX_DATA default is set to 10, but ex_data indices are allocated from 0 and require idx < MAX_EX_DATA, so supporting 11 indexes needs MAX_EX_DATA=11.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
This PR updates wolfSSL’s OpenSSL-compat behavior and build/test tooling to support OpenResty 1.31.1.1 (and its bundled Lua modules), including new CI that builds OpenResty and runs its SSL-focused Test::Nginx suites against wolfSSL.
Changes:
- Adjust OpenSSL-compat X509 BIO decoding to consume exactly one DER object per
d2i_X509_bio()call (enabling chain decoding one cert at a time). - Align OCSP status APIs with OpenSSL by returning
NULLfor absentthisUpdate/nextUpdate, and refine ticket resumption session-cache lookup behavior (skip external cache unless early data is enabled). - Add/extend API tests for these behaviors and introduce a new GitHub Actions workflow to build OpenResty 1.31.1.1 and run relevant SSL test suites.
File summaries
| File | Description |
|---|---|
wolfssl/internal.h |
Adds internal-session-cache lookup API prototype. |
src/ssl_sess.c |
Implements internal-only session-cache lookup path (bypassing external cache callback). |
src/internal.c |
Uses internal-only cache lookup for ticket resumption unless early data requires external cache participation. |
src/x509.c |
Updates d2i_X509_bio() path to decode one DER object per call. |
src/ocsp.c |
Returns NULL for missing OCSP thisUpdate/nextUpdate (OpenSSL-compatible semantics). |
configure.ac |
Sets nginx/OpenResty build defaults for MAX_EX_DATA (needs adjustment per review comment). |
CMakeLists.txt |
Mirrors nginx/OpenResty MAX_EX_DATA default logic for CMake builds (needs adjustment per review comment). |
tests/api/test_session.c |
Extends session-cache tests to cover ticket resumption + early data behavior and callback counts. |
tests/api/test_ossl_x509.c |
Adds regression test coverage for one-cert-per-call d2i_X509_bio() decoding of a DER chain. |
tests/api/test_ocsp.h |
Declares new OCSP time-handling test. |
tests/api/test_ocsp.c |
Adds OCSP test covering absent/present time fields behavior. |
tests/api.c |
Updates/extends OCSP API tests and registers the new OCSP test. |
.github/workflows/openresty.yml |
Adds CI workflow to build OpenResty 1.31.1.1 with OSP patches and run SSL test suites. |
.github/ci-deps/packages-ubuntu-24.04-full.txt |
Adds memcached dependency to support the OpenResty test workflow. |
Review details
- Files reviewed: 14/14 changed files
- Comments generated: 2
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+3894
to
+3899
| # nginx 1.31 and the OpenResty Lua modules need six ex_data slots per object. | ||
| if((WOLFSSL_NGINX OR WOLFSSL_OPENRESTY) AND | ||
| (WOLFSSL_CONTEXT_EXTRA_USER_DATA STREQUAL "no" OR | ||
| WOLFSSL_CONTEXT_EXTRA_USER_DATA STREQUAL "yes")) | ||
| list(APPEND WOLFSSL_DEFINITIONS "-DMAX_EX_DATA=10") | ||
| endif() |
Comment on lines
+12311
to
+12316
| # nginx 1.31 and the OpenResty Lua modules need six ex_data slots per object. | ||
| if test "$ENABLED_NGINX" = "yes" && \ | ||
| (test "$ENABLED_EX_DATA" = "no" || test "$ENABLED_EX_DATA" = "yes") | ||
| then | ||
| AM_CFLAGS="$AM_CFLAGS -DMAX_EX_DATA=10" | ||
| fi |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes needed by the OSP OpenResty 1.31.1.1 port, plus a GitHub Actions
workflow that runs the bundled SSL tests against wolfSSL.
d2i_X509_bio(): read one DER object per call, as OpenSSL does, since ngx_lua'sset_der_cert()decodes a chain one certificate at a time.MAX_EX_DATA: default to 10 slots for--enable-nginxunless--enable-context-extra-user-datagives a number, since nginx 1.31 and the OpenResty Lua modules together need eleven SSL ex_data indexes.wolfSSL_OCSP_resp_find_status()/wolfSSL_OCSP_single_get0_status(): return NULL for an absent thisUpdate/nextUpdate instead of a pointer to a zeroedWOLFSSL_ASN1_TIME, fixingngx.ocsp.validate_ocsp_response()failures with "invalid nextUpdate time".DoClientTicketFinalize()calling the external cache callback on every ticket resumption withWOLFSSL_TICKET_HAVE_ID. AddwolfSSL_GetSessionFromInternalCache()and use it unless the server accepts early data, matching OpenSSL's behavior and what ngx_lua'sssl_session_fetch_by_lua*expects..github/workflows/openresty.ymlto build OpenResty 1.31.1.1 with the OSP port and tests patches against--enable-openresty, running the SSL test files of ngx_lua, ngx_stream_lua and lua-resty-core plus the encrypted-session and set-misc suites via Test::Nginx. Tests needing unsupported APIs or network access are skipped. The OSP checkout currently points at julek-dev/ospopenresty-1.31.1.1pending upstream merge. memcached is added as a test dependency.Depends on wolfSSL/osp#363