Add OpenResty 1.31.1.1 support and CI

.github/ci-deps/packages-ubuntu-24.04-full.txt

@@ -81,6 +81,7 @@ libuv1-dev
 linux-libc-dev
 make
 man2html
+memcached
 meson
 mono-complete
 nghttp2

.github/workflows/openresty.yml

@@ -0,0 +1,230 @@
+name: OpenResty Tests
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'release/**' ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+# END OF COMMON SECTION
+
+jobs:
+  build_wolfssl:
+    name: Build wolfSSL
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    # Just to keep it the same as the testing target
+    runs-on: ubuntu-24.04
+    # This should be a safe limit for the tests to run.
+    timeout-minutes: 5
+    steps:
+      - name: Build wolfSSL
+        uses: wolfSSL/actions-build-autotools-project@v1
+        with:
+          path: wolfssl
+          configure: >-
+            --enable-openresty --enable-curve25519 --enable-ed25519
+          install: true
+
+      - name: tar build-dir
+        run: tar -zcf build-dir.tgz build-dir
+
+      - name: Upload built lib
+        uses: actions/upload-artifact@v6
+        with:
+          name: wolf-install-openresty
+          path: build-dir.tgz
+          retention-days: 5
+
+  openresty_check:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          # The SSL test files of the bundled Lua modules. The port patch and
+          # the tests patch come from the OSP repo.
+          #
+          # Not run (cannot work with wolfSSL, the tests patch makes them
+          # skip): ssl_client_hello_by_lua* files (ngx_lua 166, 187; stream
+          # 162, 163; lua-resty-core ssl-client-hello.t) need
+          # SSL_CTX_set_client_hello_cb; proxy_ssl_*_by_lua* files (ngx_lua
+          # 169, 170-proxy-ssl-cert; stream 164, 165-proxy-ssl-cert-by;
+          # lua-resty-core proxy-ssl*.t) need SSL_set_retry_verify; FFI into
+          # libcrypto (ngx_lua 193, stream 171, lua-resty-core
+          # socket-tcp-settrustedstore.t) needs OpenSSL symbol names.
+          # Not run (need the network): ngx_lua and stream 129-ssl-socket.t
+          # and 170-ssl-session-reuse.t.
+          - ref: 1.31.1.1
+            sha256: 65b78baadd3f0984055de89bf13f4a1932e5bfe9c31932037a134ea2b1a0ce42
+            osp-repo: julek-dev/osp
+            osp-ref: openresty-1.31.1.1
+            ngx-lua-tests: >-
+              139-ssl-cert-by.t 140-ssl-c-api.t 142-ssl-session-store.t
+              143-ssl-session-fetch.t 155-tls13.t 162-socket-tls-handshake.t
+            stream-lua-tests: >-
+              139-ssl-cert-by.t 140-ssl-c-api.t 165-serversslhandshake.t
+              166-serversslhandshake-starttls.t
+              167-serversslhandshake-errors.t
+            resty-core-tests: >-
+              ssl.t stream/ssl.t ocsp.t ssl-session-store.t
+              ssl-session-fetch.t
+    name: ${{ matrix.ref }}
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-24.04
+    # Test::Nginx restarts nginx for every block, so the suites take a while.
+    timeout-minutes: 45
+    needs: build_wolfssl
+    env:
+      OR_PREFIX: ${{ github.workspace }}/or-install
+      TEST_NGINX_BINARY: ${{ github.workspace }}/or-install/nginx/sbin/nginx
+      TEST_NGINX_USE_WOLFSSL: 1
+      TEST_NGINX_NO_SHUFFLE: 1
+      TEST_NGINX_SLEEP: 0.05
+      TEST_NGINX_MEMCACHED_PORT: 11211
+    steps:
+      - name: Checkout wolfSSL CI actions
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: .github/actions
+          fetch-depth: 1
+
+      - name: Install test dependencies
+        uses: ./.github/actions/install-apt-deps
+        with:
+          packages: libpcre2-dev zlib1g-dev memcached
+          ghcr-debs-tag: ubuntu-24.04-full
+
+      - name: Download lib
+        uses: actions/download-artifact@v7
+        with:
+          name: wolf-install-openresty
+
+      - name: untar build-dir
+        run: tar -xf build-dir.tgz
+
+      - name: Setup Perl environment
+        uses: shogo82148/actions-setup-perl@v1
+        with:
+          perl-version: '5.38.2'
+
+      - name: Install Test::Nginx
+        run: cpanm --notest Test::Nginx@0.32
+
+      - name: Checkout OSP
+        uses: actions/checkout@v5
+        with:
+          repository: ${{ matrix.osp-repo }}
+          ref: ${{ matrix.osp-ref }}
+          path: osp
+          sparse-checkout: openresty
+
+      - name: Download OpenResty
+        run: |
+          curl -fsSL -o openresty.tar.gz \
+            https://openresty.org/download/openresty-${{ matrix.ref }}.tar.gz
+          echo "${{ matrix.sha256 }}  openresty.tar.gz" | sha256sum -c
+          tar -xf openresty.tar.gz
+
+      - name: Apply OSP patches
+        working-directory: openresty-${{ matrix.ref }}
+        run: |
+          patch -p1 < ../osp/openresty/${{ matrix.ref }}.patch
+          patch -p1 < ../osp/openresty/${{ matrix.ref }}-tests.patch
+
+      # --with-debug: the tests check the debug log.
+      - name: Build OpenResty
+        working-directory: openresty-${{ matrix.ref }}
+        run: |
+          ./configure --prefix=$OR_PREFIX \
+            --with-wolfssl=$GITHUB_WORKSPACE/build-dir --with-http_ssl_module \
+            --with-stream --with-stream_ssl_module \
+            --with-stream_ssl_preread_module --with-http_v2_module \
+            --with-mail --with-mail_ssl_module --with-debug -j$(nproc)
+          make -j$(nproc)
+          make install
+
+      - name: Confirm OpenResty built with wolfSSL
+        run: |
+          ldd $TEST_NGINX_BINARY | grep wolfssl
+          $TEST_NGINX_BINARY -V 2>&1 | grep 'built with wolfSSL'
+
+      # Short paths: the tests listen on unix sockets under t/servroot.
+      # lua-resty-core expects its sibling lua-resty-lrucache by that name.
+      - name: Prepare test directories
+        working-directory: openresty-${{ matrix.ref }}/bundle
+        run: |
+          mkdir -p /tmp/ort
+          mv ngx_lua-* /tmp/ort/ngx_lua
+          mv ngx_stream_lua-* /tmp/ort/ngx_stream_lua
+          mv lua-resty-core-* /tmp/ort/lua-resty-core
+          mv lua-resty-lrucache-* /tmp/ort/lua-resty-lrucache
+          mv encrypted-session-nginx-module-* /tmp/ort/encrypted-session
+          mv set-misc-nginx-module-* /tmp/ort/set-misc
+
+      # Some blocks talk to memcached over UDP.
+      - name: Start memcached
+        run: |
+          pkill -x memcached || true
+          memcached -d -p 11211 -U 11211 -l 127.0.0.1
+
+      - if: ${{ runner.debug }}
+        name: Verbose prove
+        run: echo "prove_flags=-v" >> $GITHUB_ENV
+
+      - name: Run ngx_lua tests
+        working-directory: /tmp/ort/ngx_lua
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build-dir/lib:${{ github.workspace }}/or-install/luajit/lib
+        run: |
+          prove ${{ env.prove_flags }} -I. \
+            $(for t in ${{ matrix.ngx-lua-tests }}; do echo t/$t; done)
+
+      - if: ${{ !cancelled() }}
+        name: Run ngx_stream_lua tests
+        working-directory: /tmp/ort/ngx_stream_lua
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build-dir/lib:${{ github.workspace }}/or-install/luajit/lib
+        run: |
+          prove ${{ env.prove_flags }} -I. \
+            $(for t in ${{ matrix.stream-lua-tests }}; do echo t/$t; done)
+
+      - if: ${{ !cancelled() }}
+        name: Run lua-resty-core tests
+        working-directory: /tmp/ort/lua-resty-core
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build-dir/lib:${{ github.workspace }}/or-install/luajit/lib
+        run: |
+          prove ${{ env.prove_flags }} -I. \
+            $(for t in ${{ matrix.resty-core-tests }}; do echo t/$t; done)
+
+      # These two modules use the OpenSSL compatibility layer directly.
+      - if: ${{ !cancelled() }}
+        name: Run encrypted-session tests
+        working-directory: /tmp/ort/encrypted-session
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build-dir/lib:${{ github.workspace }}/or-install/luajit/lib
+        run: prove ${{ env.prove_flags }} -I. t/sanity.t
+
+      - if: ${{ !cancelled() }}
+        name: Run set-misc tests
+        working-directory: /tmp/ort/set-misc
+        env:
+          LD_LIBRARY_PATH: ${{ github.workspace }}/build-dir/lib:${{ github.workspace }}/or-install/luajit/lib
+        run: prove ${{ env.prove_flags }} -I. t/hmac.t
+
+      - if: ${{ failure() }}
+        name: Upload nginx logs
+        uses: actions/upload-artifact@v6
+        with:
+          name: openresty-${{ matrix.ref }}-logs
+          path: |
+            /tmp/ort/*/t/servroot*/logs/*.log
+            /tmp/ort/*/t/servroot*/conf/nginx.conf
+          retention-days: 5

CMakeLists.txt

@@ -3891,6 +3891,13 @@ if(NOT WOLFSSL_CONTEXT_EXTRA_USER_DATA STREQUAL "no")
     endif()
 endif()
 
+# nginx 1.31 and the OpenResty Lua modules need six ex_data slots per object.
+if((WOLFSSL_NGINX OR WOLFSSL_OPENRESTY) AND
+   (WOLFSSL_CONTEXT_EXTRA_USER_DATA STREQUAL "no" OR
+    WOLFSSL_CONTEXT_EXTRA_USER_DATA STREQUAL "yes"))
+    list(APPEND WOLFSSL_DEFINITIONS "-DMAX_EX_DATA=10")
+endif()
+
 # ECC minimum key size (bits)
 if(WOLFSSL_FIPS)
     set(WOLFSSL_ECC_MIN_KEY_SZ_DEFAULT "192")

configure.ac

@@ -12308,6 +12308,13 @@ yes) AM_CFLAGS="$AM_CFLAGS -DHAVE_EX_DATA"
    ;;
 esac
 
+# nginx 1.31 and the OpenResty Lua modules need six ex_data slots per object.
+if test "$ENABLED_NGINX" = "yes" && \
+   (test "$ENABLED_EX_DATA" = "no" || test "$ENABLED_EX_DATA" = "yes")
+then
+    AM_CFLAGS="$AM_CFLAGS -DMAX_EX_DATA=10"
+fi
+
 # IoT-Safe support
 AC_ARG_ENABLE([iotsafe],
     [AS_HELP_STRING([--enable-iotsafe],[Enables support for IoT-Safe secure applet (default: disabled)])],

src/internal.c

@@ -43738,9 +43738,18 @@ static int AddPSKtoPreMasterSecret(WOLFSSL* ssl)
             XMEMCPY(ssl->session->sessionID, bogusID, ID_LEN);
             ssl->session->sessionIDSz= bogusIDSz;
         }
-#ifdef WOLFSSL_TICKET_HAVE_ID
+#if defined(WOLFSSL_TICKET_HAVE_ID) && !defined(NO_SESSION_CACHE)
         else {
-            if (wolfSSL_GetSession(ssl, NULL, 1) != NULL) {
+            int found;
+            /* The external cache takes part in the 0-RTT anti-replay
+             * eviction, so it is only skipped when early data is off. */
+#ifdef WOLFSSL_EARLY_DATA
+            if (ssl->options.maxEarlyDataSz > 0)
+                found = wolfSSL_GetSessionFromCache(ssl, ssl->session);
+            else
+#endif
+                found = wolfSSL_GetSessionFromInternalCache(ssl, ssl->session);
+            if (found == WOLFSSL_SUCCESS) {
                 WOLFSSL_MSG("Found session matching the session id"
                             " found in the ticket");
             }

src/ocsp.c

@@ -730,10 +730,15 @@ int wolfSSL_OCSP_resp_find_status(WOLFSSL_OCSP_BASICRESP *bs,
     if (status != NULL)
         *status = single->status->status;
 #ifdef WOLFSSL_OCSP_PARSE_STATUS
-    if (thisupd != NULL)
-        *thisupd = &single->status->thisDateParsed;
-    if (nextupd != NULL)
-        *nextupd = &single->status->nextDateParsed;
+    /* NULL when the response has no such field, as with OpenSSL. */
+    if (thisupd != NULL) {
+        *thisupd = (single->status->thisDateParsed.length > 0) ?
+            &single->status->thisDateParsed : NULL;
+    }
+    if (nextupd != NULL) {
+        *nextupd = (single->status->nextDateParsed.length > 0) ?
+            &single->status->nextDateParsed : NULL;
+    }
 #else
     if (thisupd != NULL)
         *thisupd = NULL;
@@ -1636,10 +1641,15 @@ int wolfSSL_OCSP_single_get0_status(WOLFSSL_OCSP_SINGLERESP *single,
         return -1;
 
 #ifdef WOLFSSL_OCSP_PARSE_STATUS
-    if (thisupd != NULL)
-        *thisupd = &single->status->thisDateParsed;
-    if (nextupd != NULL)
-        *nextupd = &single->status->nextDateParsed;
+    /* NULL when the response has no such field, as with OpenSSL. */
+    if (thisupd != NULL) {
+        *thisupd = (single->status->thisDateParsed.length > 0) ?
+            &single->status->thisDateParsed : NULL;
+    }
+    if (nextupd != NULL) {
+        *nextupd = (single->status->nextDateParsed.length > 0) ?
+            &single->status->nextDateParsed : NULL;
+    }
 #else
     if (thisupd != NULL)
         *thisupd = NULL;

src/ssl_sess.c

@@ -1217,7 +1217,8 @@ int TlsSessionCacheGetAndWrLock(const byte *id, WOLFSSL_SESSION **sess,
             lockedRow, 0, side);
 }
 
-int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
+static int GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output,
+        byte internalOnly)
 {
     const WOLFSSL_SESSION* sess = NULL;
     const byte*  id = NULL;
@@ -1235,7 +1236,9 @@ int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
     byte         bogusID[ID_LEN];
     byte         bogusIDSz = 0;
 
-    WOLFSSL_ENTER("wolfSSL_GetSessionFromCache");
+    WOLFSSL_ENTER("GetSessionFromCache");
+
+    (void)internalOnly;
 
     if (output == NULL) {
         WOLFSSL_MSG("NULL output");
@@ -1270,7 +1273,7 @@ int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
 
 
 #ifdef HAVE_EXT_CACHE
-    if (ssl->ctx->get_sess_cb != NULL) {
+    if (!internalOnly && ssl->ctx->get_sess_cb != NULL) {
         int copy = 0;
         int found = 0;
         WOLFSSL_SESSION* extSess;
@@ -1499,6 +1502,18 @@ int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
     return error;
 }
 
+int wolfSSL_GetSessionFromCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
+{
+    return GetSessionFromCache(ssl, output, 0);
+}
+
+/* Lookup by the ID carried in a decrypted ticket without calling the
+ * external cache callback. */
+int wolfSSL_GetSessionFromInternalCache(WOLFSSL* ssl, WOLFSSL_SESSION* output)
+{
+    return GetSessionFromCache(ssl, output, 1);
+}
+
 WOLFSSL_SESSION* wolfSSL_GetSession(WOLFSSL* ssl, byte* masterSecret,
         byte restoreSessionCerts)
 {