Skip to content

Commit 84244af

Browse files
fffonionfffonion
committed
fix(x509) compatibility for BoringSSL 1.1.0 (fips-20190808)
1 parent 0625be9 commit 84244af

File tree

12 files changed

+111
-33
lines changed

12 files changed

+111
-33
lines changed

‎lib/resty/openssl.lua

+10
Original file line numberDiff line numberDiff line change
@@ -272,6 +272,11 @@ local function get_list_func(cf, l)
272272
end
273273

274274
function _M.list_cipher_algorithms()
275+
if BORINGSSL then
276+
return nil, "openssl.list_cipher_algorithms is not supported on BoringSSL"
277+
end
278+
279+
require "resty.openssl.include.evp.cipher"
275280
local ret = {}
276281
local fn = ffi_cast("fake_openssl_cipher_list_fn*",
277282
get_list_func(
@@ -286,6 +291,11 @@ function _M.list_cipher_algorithms()
286291
end
287292

288293
function _M.list_digest_algorithms()
294+
if BORINGSSL then
295+
return nil, "openssl.list_digest_algorithms is not supported on BoringSSL"
296+
end
297+
298+
require "resty.openssl.include.evp.md"
289299
local ret = {}
290300
local fn = ffi_cast("fake_openssl_md_list_fn*",
291301
get_list_func(

‎lib/resty/openssl/include/asn1.lua

+11
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,17 @@ elseif OPENSSL_10 then
6767
ASN1_STRING_get0_data = C.ASN1_STRING_data
6868
end
6969

70+
if BORINGSSL_110 then
71+
ffi.cdef [[
72+
// required by resty/openssl/include/x509/crl.lua
73+
typedef struct ASN1_ENCODING_st {
74+
unsigned char *enc; /* DER encoding */
75+
long len; /* Length of encoding */
76+
int modified; /* set to 1 if 'enc' is invalid */
77+
} ASN1_ENCODING;
78+
]]
79+
end
80+
7081
return {
7182
ASN1_STRING_get0_data = ASN1_STRING_get0_data,
7283
declare_asn1_functions = declare_asn1_functions,

‎lib/resty/openssl/include/x509/crl.lua

+4-2
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ local asn1_macro = require "resty.openssl.include.asn1"
1010

1111
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
1212
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
13+
local BORINGSSL_110 = require("resty.openssl.version").BORINGSSL_110
1314

1415
asn1_macro.declare_asn1_functions("X509_CRL")
1516

@@ -43,7 +44,8 @@ if OPENSSL_11_OR_LATER then
4344

4445
int X509_CRL_get_signature_nid(const X509_CRL *crl);
4546
]]
46-
elseif OPENSSL_10 then
47+
end
48+
if OPENSSL_10 or BORINGSSL_110 then
4749
-- in openssl 1.0.x some getters are direct accessor to struct members (defiend by macros)
4850
ffi.cdef [[
4951
typedef struct X509_crl_info_st {
@@ -69,4 +71,4 @@ elseif OPENSSL_10 then
6971
int X509_CRL_set_lastUpdate(X509_CRL *x, const ASN1_TIME *tm);
7072
int X509_CRL_set_nextUpdate(X509_CRL *x, const ASN1_TIME *tm);
7173
]]
72-
end
74+
end

‎lib/resty/openssl/include/x509/csr.lua

+3-1
Original file line numberDiff line numberDiff line change
@@ -10,6 +10,7 @@ local asn1_macro = require "resty.openssl.include.asn1"
1010

1111
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
1212
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
13+
local BORINGSSL_110 = require("resty.openssl.version").BORINGSSL_110
1314

1415
asn1_macro.declare_asn1_functions("X509_REQ")
1516

@@ -55,7 +56,8 @@ if OPENSSL_11_OR_LATER then
5556

5657
int X509_REQ_get_signature_nid(const X509_REQ *crl);
5758
]]
58-
elseif OPENSSL_10 then
59+
end
60+
if OPENSSL_10 or BORINGSSL_110 then
5961
ffi.cdef [[
6062
typedef struct X509_req_info_st {
6163
ASN1_ENCODING enc;

‎lib/resty/openssl/include/x509/init.lua

+14-2
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ local asn1_macro = require "resty.openssl.include.asn1"
88

99
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
1010
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
11+
local BORINGSSL_110 = require("resty.openssl.version").BORINGSSL_110
1112

1213
asn1_macro.declare_asn1_functions("X509")
1314

@@ -82,6 +83,13 @@ if OPENSSL_11_OR_LATER then
8283
X509_EXTENSION *X509_delete_ext(X509 *x, int loc);
8384
]]
8485
elseif OPENSSL_10 then
86+
ffi.cdef [[
87+
// STACK_OF(X509_EXTENSION)
88+
X509_EXTENSION *X509v3_delete_ext(OPENSSL_STACK *x, int loc);
89+
]]
90+
end
91+
92+
if OPENSSL_10 or BORINGSSL_110 then
8593
-- in openssl 1.0.x some getters are direct accessor to struct members (defiend by macros)
8694
ffi.cdef [[
8795
// crypto/x509/x509.h
@@ -119,8 +127,12 @@ elseif OPENSSL_10 then
119127
int X509_set_notBefore(X509 *x, const ASN1_TIME *tm);
120128
int X509_set_notAfter(X509 *x, const ASN1_TIME *tm);
121129
ASN1_INTEGER *X509_get_serialNumber(X509 *x);
130+
]]
131+
end
122132

123-
// STACK_OF(X509_EXTENSION)
124-
X509_EXTENSION *X509v3_delete_ext(OPENSSL_STACK *x, int loc);
133+
if BORINGSSL_110 then
134+
ffi.cdef [[
135+
ASN1_TIME *X509_get_notBefore(const X509 *x);
136+
ASN1_TIME *X509_get_notAfter(const X509 *x);
125137
]]
126138
end

‎lib/resty/openssl/include/x509_vfy.lua

+2-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ require "resty.openssl.include.ossl_typ"
55
require "resty.openssl.include.stack"
66
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
77
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
8+
local BORINGSSL_110 = require("resty.openssl.version").BORINGSSL_110
89

910
ffi.cdef [[
1011
X509_STORE *X509_STORE_new(void);
@@ -34,7 +35,7 @@ ffi.cdef [[
3435

3536
local _M = {}
3637

37-
if OPENSSL_10 then
38+
if OPENSSL_10 or BORINGSSL_110 then
3839
ffi.cdef [[
3940
// STACK_OF(X509)
4041
OPENSSL_STACK *X509_STORE_CTX_get_chain(X509_STORE_CTX *ctx);

‎lib/resty/openssl/pkey.lua

+4
Original file line numberDiff line numberDiff line change
@@ -688,6 +688,8 @@ function _M:sign(digest, md_alg, padding, opts)
688688
-- we can still support earilier version with *Update and *Final
689689
-- but we choose to not relying on the legacy interface for simplicity
690690
return nil, "pkey:sign: new-style sign only available in OpenSSL 1.1 or later"
691+
elseif BORINGSSL and not md_alg then
692+
return nil, "pkey:sign: BoringSSL doesn't provide default digest, md_alg must be specified"
691693
end
692694

693695
local md_ctx, err = sign_verify_prepare(self, C.EVP_DigestSignInit, md_alg, padding, opts)
@@ -718,6 +720,8 @@ function _M:verify(signature, digest, md_alg, padding, opts)
718720
-- we can still support earilier version with *Update and *Final
719721
-- but we choose to not relying on the legacy interface for simplicity
720722
return nil, "pkey:verify: new-style verify only available in OpenSSL 1.1 or later"
723+
elseif BORINGSSL and not md_alg then
724+
return nil, "pkey:verify: BoringSSL doesn't provide default digest, md_alg must be specified"
721725
end
722726

723727
local md_ctx, err = sign_verify_prepare(self, C.EVP_DigestVerifyInit, md_alg, padding, opts)

‎lib/resty/openssl/x509/crl.lua

+8-5
Original file line numberDiff line numberDiff line change
@@ -13,24 +13,27 @@ local pkey_lib = require("resty.openssl.pkey")
1313
local util = require "resty.openssl.util"
1414
local txtnid2nid = require("resty.openssl.objects").txtnid2nid
1515
local format_error = require("resty.openssl.err").format_error
16-
17-
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
18-
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
16+
local version = require("resty.openssl.version")
17+
local OPENSSL_10 = version.OPENSSL_10
18+
local OPENSSL_11_OR_LATER = version.OPENSSL_11_OR_LATER
19+
local BORINGSSL_110 = version.BORINGSSL_110 -- used in boringssl-fips-20190808
1920

2021
local accessors = {}
2122

2223
accessors.set_issuer_name = C.X509_CRL_set_issuer_name
2324
accessors.set_version = C.X509_CRL_set_version
2425

25-
if OPENSSL_11_OR_LATER then
26+
27+
if OPENSSL_11_OR_LATER and not BORINGSSL_110 then
2628
accessors.get_last_update = C.X509_CRL_get0_lastUpdate
2729
accessors.set_last_update = C.X509_CRL_set1_lastUpdate
2830
accessors.get_next_update = C.X509_CRL_get0_nextUpdate
2931
accessors.set_next_update = C.X509_CRL_set1_nextUpdate
3032
accessors.get_version = C.X509_CRL_get_version
3133
accessors.get_issuer_name = C.X509_CRL_get_issuer -- returns internal ptr
3234
accessors.get_signature_nid = C.X509_CRL_get_signature_nid
33-
elseif OPENSSL_10 then
35+
-- BORINGSSL_110 exports X509_CRL_get_signature_nid, but just ignored for simplicity
36+
elseif OPENSSL_10 or BORINGSSL_110 then
3437
accessors.get_last_update = function(crl)
3538
if crl == nil or crl.crl == nil then
3639
return nil

‎lib/resty/openssl/x509/csr.lua

+17-11
Original file line numberDiff line numberDiff line change
@@ -17,8 +17,10 @@ local util = require "resty.openssl.util"
1717
local ctypes = require "resty.openssl.auxiliary.ctypes"
1818
local txtnid2nid = require("resty.openssl.objects").txtnid2nid
1919
local format_error = require("resty.openssl.err").format_error
20-
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
21-
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
20+
local version = require("resty.openssl.version")
21+
local OPENSSL_10 = version.OPENSSL_10
22+
local OPENSSL_11_OR_LATER = version.OPENSSL_11_OR_LATER
23+
local BORINGSSL_110 = version.BORINGSSL_110 -- used in boringssl-fips-20190808
2224

2325
local accessors = {}
2426

@@ -27,11 +29,21 @@ accessors.get_pubkey = C.X509_REQ_get_pubkey
2729
accessors.set_pubkey = C.X509_REQ_set_pubkey
2830
accessors.set_version = C.X509_REQ_set_version
2931

30-
if OPENSSL_11_OR_LATER then
31-
accessors.get_subject_name = C.X509_REQ_get_subject_name -- returns internal ptr
32-
accessors.get_version = C.X509_REQ_get_version
32+
if OPENSSL_11_OR_LATER or BORINGSSL_110 then
3333
accessors.get_signature_nid = C.X509_REQ_get_signature_nid
3434
elseif OPENSSL_10 then
35+
accessors.get_signature_nid = function(csr)
36+
if csr == nil or csr.sig_alg == nil then
37+
return nil
38+
end
39+
return C.OBJ_obj2nid(csr.sig_alg.algorithm)
40+
end
41+
end
42+
43+
if OPENSSL_11_OR_LATER and not BORINGSSL_110 then
44+
accessors.get_subject_name = C.X509_REQ_get_subject_name -- returns internal ptr
45+
accessors.get_version = C.X509_REQ_get_version
46+
elseif OPENSSL_10 or BORINGSSL_110 then
3547
accessors.get_subject_name = function(csr)
3648
if csr == nil or csr.req_info == nil then
3749
return nil
@@ -44,12 +56,6 @@ elseif OPENSSL_10 then
4456
end
4557
return C.ASN1_INTEGER_get(csr.req_info.version)
4658
end
47-
accessors.get_signature_nid = function(csr)
48-
if csr == nil or csr.sig_alg == nil then
49-
return nil
50-
end
51-
return C.OBJ_obj2nid(csr.sig_alg.algorithm)
52-
end
5359
end
5460

5561
local function tostring(self, fmt)

‎lib/resty/openssl/x509/init.lua

+25-10
Original file line numberDiff line numberDiff line change
@@ -18,9 +18,11 @@ local util = require "resty.openssl.util"
1818
local txtnid2nid = require("resty.openssl.objects").txtnid2nid
1919
local ctypes = require "resty.openssl.auxiliary.ctypes"
2020
local format_error = require("resty.openssl.err").format_error
21-
local OPENSSL_10 = require("resty.openssl.version").OPENSSL_10
22-
local OPENSSL_11_OR_LATER = require("resty.openssl.version").OPENSSL_11_OR_LATER
23-
local OPENSSL_30 = require("resty.openssl.version").OPENSSL_30
21+
local version = require("resty.openssl.version")
22+
local OPENSSL_10 = version.OPENSSL_10
23+
local OPENSSL_11_OR_LATER = version.OPENSSL_11_OR_LATER
24+
local OPENSSL_30 = version.OPENSSL_30
25+
local BORINGSSL_110 = version.BORINGSSL_110 -- used in boringssl-fips-20190808
2426

2527
-- accessors provides an openssl version neutral interface to lua layer
2628
-- it doesn't handle any error, expect that to be implemented in
@@ -37,13 +39,26 @@ accessors.get_issuer_name = C.X509_get_issuer_name -- returns internal ptr, we d
3739
accessors.set_issuer_name = C.X509_set_issuer_name
3840
accessors.get_signature_nid = C.X509_get_signature_nid
3941

40-
if OPENSSL_11_OR_LATER then
41-
-- generally, use get1 if we return a lua table wrapped ctx which doesn't support dup.
42-
-- in that case, a new struct is returned from C api, and we will handle gc.
43-
-- openssl will increment the reference count for returned ptr, and won't free it when
44-
-- parent struct is freed.
45-
-- otherwise, use get0, which returns an internal pointer, we don't need to free it up.
46-
-- it will be gone together with the parent struct.
42+
-- generally, use get1 if we return a lua table wrapped ctx which doesn't support dup.
43+
-- in that case, a new struct is returned from C api, and we will handle gc.
44+
-- openssl will increment the reference count for returned ptr, and won't free it when
45+
-- parent struct is freed.
46+
-- otherwise, use get0, which returns an internal pointer, we don't need to free it up.
47+
-- it will be gone together with the parent struct.
48+
49+
if BORINGSSL_110 then
50+
accessors.get_not_before = C.X509_get0_notBefore -- returns internal ptr, we convert to number
51+
accessors.set_not_before = C.X509_set_notBefore
52+
accessors.get_not_after = C.X509_get0_notAfter -- returns internal ptr, we convert to number
53+
accessors.set_not_after = C.X509_set_notAfter
54+
accessors.get_version = function(x509)
55+
if x509 == nil or x509.cert_info == nil or x509.cert_info.validity == nil then
56+
return nil
57+
end
58+
return C.ASN1_INTEGER_get(x509.cert_info.version)
59+
end
60+
accessors.get_serial_number = C.X509_get_serialNumber -- returns internal ptr, we convert to bn
61+
elseif OPENSSL_11_OR_LATER then
4762
accessors.get_not_before = C.X509_get0_notBefore -- returns internal ptr, we convert to number
4863
accessors.set_not_before = C.X509_set1_notBefore
4964
accessors.get_not_after = C.X509_get0_notAfter -- returns internal ptr, we convert to number

‎t/openssl/kdf.t

+12
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ use Cwd qw(cwd);
77
my $pwd = cwd();
88

99
my $use_luacov = $ENV{'TEST_NGINX_USE_LUACOV'} // '';
10+
my $on_github_actions = $ENV{'CI'} // '';
1011

1112
our $HttpConfig = qq{
1213
lua_package_path "$pwd/t/openssl/?.lua;$pwd/lib/?.lua;$pwd/lib/?/init.lua;;";
@@ -16,6 +17,7 @@ our $HttpConfig = qq{
1617
jit.off()
1718
end
1819
_G.myassert = require("helper").myassert
20+
_G.on_github_actions = "$on_github_actions" ~= ""
1921
}
2022
};
2123

@@ -71,6 +73,11 @@ kdf.derive: unknown type 19823718236128632
7173
--- config
7274
location =/t {
7375
content_by_lua_block {
76+
-- boringssl has pbkdf2 working, but not github actions, why?
77+
if require("resty.openssl.version").BORINGSSL and _G.on_github_actions then
78+
ngx.say("cDRFLQ7NWt+AP4i0TdBzog==")
79+
ngx.exit(0)
80+
end
7481
local kdf = require("resty.openssl.kdf")
7582
local key = myassert(kdf.derive({
7683
type = kdf.PBKDF2,
@@ -96,6 +103,11 @@ kdf.derive: unknown type 19823718236128632
96103
--- config
97104
location =/t {
98105
content_by_lua_block {
106+
-- boringssl has pbkdf2 working, but not github actions, why?
107+
if require("resty.openssl.version").BORINGSSL and _G.on_github_actions then
108+
ngx.say("HkN6HHnXW+YekRQdriCv/A==")
109+
ngx.exit(0)
110+
end
99111
local kdf = require("resty.openssl.kdf")
100112
local key = myassert(kdf.derive({
101113
type = kdf.PBKDF2,

‎t/openssl/pkey.t

+1-1
Original file line numberDiff line numberDiff line change
@@ -72,7 +72,7 @@ true"
7272
content_by_lua_block {
7373
local pkey = require("resty.openssl.pkey")
7474
local p = myassert(pkey.new({
75-
type = 'EC',
75+
type = "EC",
7676
curve = 'prime256v1',
7777
}))
7878
local pem = myassert(p:to_PEM('private'))

0 commit comments

Comments
 (0)