Skip to content

Commit

Permalink
feat: support openssl3 (apache#10724)
Browse files Browse the repository at this point in the history
  • Loading branch information
@AlinsRan
AlinsRan authored Dec 28, 2023
1 parent 593e4c2 commit 538b964
Show file tree
Hide file tree
Showing 14 changed files with 62 additions and 109 deletions.
5 changes: 0 additions & 5 deletions .github/workflows/cli-master.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -6,11 +6,6 @@ on:
paths-ignore:
- 'docs/**'
- '**/*.md'
pull_request:
branches: [master]
paths-ignore:
- 'docs/**'
- '**/*.md'

concurrency:
group: ${{ github.workflow }}-${{ github.ref == 'refs/heads/master' && github.run_number || github.ref }}
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/code-lint.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,9 @@ jobs:
export_or_prefix
export OPENRESTY_VERSION=default
./ci/linux-install-openresty.sh
sudo -E ./ci/linux-install-openresty.sh
./utils/linux-install-luarocks.sh
sudo luarocks install luacheck
sudo -E luarocks install luacheck
- name: Script
run: |
Expand Down
34 changes: 3 additions & 31 deletions .github/workflows/fips.yml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ jobs:
env:
SERVER_NAME: ${{ matrix.os_name }}
OPENRESTY_VERSION: default
ENABLE_FIPS: true

steps:
- name: Check out code
Expand All @@ -54,28 +55,6 @@ jobs:
path: deps
key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.os_name }}-${{ hashFiles('apisix-master-0.rockspec') }}

- name: Cache openssl-3.0 compilation
id: cache-openssl
uses: actions/cache@v3
env:
cache-name: cache-openssl
with:
path: ~/openssl-3.0
key: ${{ runner.os }}-${{ env.cache-name }}-${{ matrix.os_name }}

- name: set openssl prefix
id: set_openssl_prefix
shell: bash
run: |
echo "openssl3_prefix=$HOME" >>$GITHUB_OUTPUT
- name: Toggle openssl compile
id: test_ssl_env
shell: bash
if: steps.cache-openssl.outputs.cache-hit != 'true'
run: |
echo "openssl3=yes" >>$GITHUB_OUTPUT
- name: Extract test type
shell: bash
id: test_env
Expand Down Expand Up @@ -139,16 +118,9 @@ jobs:
run: sudo ./ci/${{ matrix.os_name }}_runner.sh before_install

- name: Linux Install
env:
COMPILE_OPENSSL3: ${{ steps.test_ssl_env.outputs.openssl3 }}
OPENSSL3_PREFIX: ${{ steps.set_openssl_prefix.outputs.openssl3_prefix }}
USE_OPENSSL3: yes
run: |
sudo --preserve-env=OPENRESTY_VERSION \
--preserve-env=COMPILE_OPENSSL3 \
--preserve-env=OPENSSL3_PREFIX \
--preserve-env=USE_OPENSSL3 \
./ci/${{ matrix.os_name }}_runner.sh do_install
sudo --preserve-env=ENABLE_FIPS \
./ci/${{ matrix.os_name }}_runner.sh do_install
- name: Linux Script
env:
Expand Down
2 changes: 1 addition & 1 deletion .requirements
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,4 +17,4 @@

APISIX_PACKAGE_NAME=apisix

APISIX_RUNTIME=1.0.2
APISIX_RUNTIME=1.1.0
12 changes: 6 additions & 6 deletions Makefile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -40,7 +40,7 @@ ENV_DOCKER ?= docker
ENV_DOCKER_COMPOSE ?= docker-compose --project-directory $(CURDIR) -p $(project_name) -f $(project_compose_ci)
ENV_NGINX ?= $(ENV_NGINX_EXEC) -p $(CURDIR) -c $(CURDIR)/conf/nginx.conf
ENV_NGINX_EXEC := $(shell command -v openresty 2>/dev/null || command -v nginx 2>/dev/null)
ENV_OPENSSL_PREFIX ?= $(addprefix $(ENV_NGINX_PREFIX), openssl)
ENV_OPENSSL_PREFIX ?= $(addprefix $(ENV_NGINX_PREFIX), openssl3)
ENV_LUAROCKS ?= luarocks
## These variables can be injected by luarocks
ENV_INST_PREFIX ?= /usr
Expand All @@ -59,9 +59,9 @@ endif
# Execute only in the presence of ENV_NGINX_EXEC to avoid unexpected error output
ifneq ($(ENV_NGINX_EXEC), )
ENV_NGINX_PREFIX := $(shell $(ENV_NGINX_EXEC) -V 2>&1 | grep -Eo 'prefix=(.*)/nginx\s+' | grep -Eo '/.*/')
# OpenResty 1.17.8 or higher version uses openssl111 as the openssl dirname.
ifeq ($(shell test -d $(addprefix $(ENV_NGINX_PREFIX), openssl111) && echo -n yes), yes)
ENV_OPENSSL_PREFIX := $(addprefix $(ENV_NGINX_PREFIX), openssl111)
# OpenResty 1.17.8 or higher version uses openssl3 as the openssl dirname.
ifeq ($(shell test -d $(addprefix $(ENV_NGINX_PREFIX), openssl3) && echo -n yes), yes)
ENV_OPENSSL_PREFIX := $(addprefix $(ENV_NGINX_PREFIX), openssl3)
endif
endif

Expand All @@ -80,8 +80,8 @@ ifeq ($(ENV_OS_NAME), darwin)
ifeq ($(shell test -d $(ENV_HOMEBREW_PREFIX)/opt/openresty-openssl && echo -n yes), yes)
ENV_OPENSSL_PREFIX := $(ENV_HOMEBREW_PREFIX)/opt/openresty-openssl
endif
ifeq ($(shell test -d $(ENV_HOMEBREW_PREFIX)/opt/openresty-openssl111 && echo -n yes), yes)
ENV_OPENSSL_PREFIX := $(ENV_HOMEBREW_PREFIX)/opt/openresty-openssl111
ifeq ($(shell test -d $(ENV_HOMEBREW_PREFIX)/opt/openresty-openssl3 && echo -n yes), yes)
ENV_OPENSSL_PREFIX := $(ENV_HOMEBREW_PREFIX)/opt/openresty-openssl3
endif
ifeq ($(shell test -d $(ENV_HOMEBREW_PREFIX)/opt/pcre && echo -n yes), yes)
ENV_PCRE_PREFIX := $(ENV_HOMEBREW_PREFIX)/opt/pcre
Expand Down
2 changes: 1 addition & 1 deletion apisix-master-0.rockspec
View file
Original file line number Diff line number Diff line change
Expand Up @@ -65,7 +65,7 @@ dependencies = {
"graphql = 0.0.2",
"argparse = 0.7.1-1",
"luasocket = 3.1.0-1",
"luasec = 0.9-1",
"luasec = 1.3.2-1",
"lua-resty-consul = 0.3-2",
"penlight = 1.13.1",
"ext-plugin-proto = 0.6.1",
Expand Down
17 changes: 11 additions & 6 deletions ci/centos7-ci.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,12 @@ install_dependencies() {
export_or_prefix

# install build & runtime deps
yum install -y wget tar gcc automake autoconf libtool make unzip \
git sudo openldap-devel which ca-certificates openssl-devel \
epel-release
yum install -y wget tar gcc gcc-c++ automake autoconf libtool make unzip patch \
git sudo openldap-devel which ca-certificates \
openresty-pcre-devel openresty-zlib-devel \
epel-release \
cpanminus perl \
openssl-devel

# install newer curl
yum makecache
Expand All @@ -40,12 +43,14 @@ install_dependencies() {

# install openresty to make apisix's rpm test work
yum install -y yum-utils && yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo
export luajit_xcflags="-DLUAJIT_ASSERT -DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT -O0"
export debug_args=--with-debug

wget "https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/build-apisix-runtime-debug-centos7.sh"
wget "https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/build-apisix-runtime.sh"
chmod +x build-apisix-runtime-debug-centos7.sh
chmod +x build-apisix-runtime.sh
./build-apisix-runtime-debug-centos7.sh
./build-apisix-runtime.sh latest
curl -o /usr/local/openresty/openssl3/ssl/openssl.cnf \
https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/conf/openssl3/openssl.cnf

# patch lua-resty-events
sed -i 's/log(ERR, "event worker failed: ", perr)/log(ngx.WARN, "event worker failed: ", perr)/' /usr/local/openresty/lualib/resty/events/worker.lua
Expand Down
3 changes: 2 additions & 1 deletion ci/common.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -25,7 +25,8 @@ export_or_prefix() {
export OPENRESTY_PREFIX="/usr/local/openresty"
export APISIX_MAIN="https://raw.githubusercontent.com/apache/apisix/master/apisix-master-0.rockspec"
export PATH=$OPENRESTY_PREFIX/nginx/sbin:$OPENRESTY_PREFIX/luajit/bin:$OPENRESTY_PREFIX/bin:$PATH
export OPENSSL111_BIN=$OPENRESTY_PREFIX/openssl111/bin/openssl
export OPENSSL_PREFIX=$OPENRESTY_PREFIX/openssl3
export OPENSSL_BIN=$OPENSSL_PREFIX/bin/openssl
}

create_lua_deps() {
Expand Down
40 changes: 8 additions & 32 deletions ci/linux-install-openresty.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,41 +35,12 @@ sudo add-apt-repository -y "deb https://openresty.org/package/${arch_path}ubuntu
sudo add-apt-repository -y "deb http://repos.apiseven.com/packages/${arch_path}debian bullseye main"

sudo apt-get update
sudo apt-get install -y openresty-openssl111 openresty-openssl111-dev libldap2-dev openresty-pcre openresty-zlib
sudo apt-get install -y libldap2-dev openresty-pcre-dev openresty-zlib-dev build-essential gcc g++ cpanminus

COMPILE_OPENSSL3=${COMPILE_OPENSSL3-no}
USE_OPENSSL3=${USE_OPENSSL3-no}
OPENSSL3_PREFIX=${OPENSSL3_PREFIX-/home/runner}
SSL_LIB_VERSION=${SSL_LIB_VERSION-openssl}
ENABLE_FIPS=${ENABLE_FIPS:-"false"}

if [ "$OPENRESTY_VERSION" == "source" ]; then
export openssl_prefix=/usr/local/openresty/openssl111
export zlib_prefix=/usr/local/openresty/zlib
export pcre_prefix=/usr/local/openresty/pcre

export cc_opt="-DNGX_LUA_ABORT_AT_PANIC -I${zlib_prefix}/include -I${pcre_prefix}/include -I${openssl_prefix}/include"
export ld_opt="-L${zlib_prefix}/lib -L${pcre_prefix}/lib -L${openssl_prefix}/lib -Wl,-rpath,${zlib_prefix}/lib:${pcre_prefix}/lib:${openssl_prefix}/lib"

if [ "$COMPILE_OPENSSL3" == "yes" ]; then
apt install -y build-essential
git clone https://github.com/openssl/openssl
cd openssl
./Configure --prefix=$OPENSSL3_PREFIX/openssl-3.0 enable-fips
make install
bash -c "echo $OPENSSL3_PREFIX/openssl-3.0/lib64 > /etc/ld.so.conf.d/openssl3.conf"
ldconfig
$OPENSSL3_PREFIX/openssl-3.0/bin/openssl fipsinstall -out $OPENSSL3_PREFIX/openssl-3.0/ssl/fipsmodule.cnf -module $OPENSSL3_PREFIX/openssl-3.0/lib64/ossl-modules/fips.so
sed -i 's@# .include fipsmodule.cnf@.include '"$OPENSSL3_PREFIX"'/openssl-3.0/ssl/fipsmodule.cnf@g; s/# \(fips = fips_sect\)/\1\nbase = base_sect\n\n[base_sect]\nactivate=1\n/g' $OPENSSL3_PREFIX/openssl-3.0/ssl/openssl.cnf
cd ..
fi

if [ "$USE_OPENSSL3" == "yes" ]; then
bash -c "echo $OPENSSL3_PREFIX/openssl-3.0/lib64 > /etc/ld.so.conf.d/openssl3.conf"
ldconfig
export cc_opt="-I$OPENSSL3_PREFIX/openssl-3.0/include"
export ld_opt="-L$OPENSSL3_PREFIX/openssl-3.0/lib64 -Wl,-rpath,$OPENSSL3_PREFIX/openssl-3.0/lib64"
fi

if [ "$SSL_LIB_VERSION" == "tongsuo" ]; then
export openssl_prefix=/usr/local/tongsuo
export zlib_prefix=$OPENRESTY_PREFIX/zlib
Expand All @@ -84,5 +55,10 @@ wget "https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/$
chmod +x build-apisix-runtime.sh
./build-apisix-runtime.sh latest

if [ ! "$ENABLE_FIPS" == "true" ]; then
curl -o /usr/local/openresty/openssl3/ssl/openssl.cnf \
https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/conf/openssl3/openssl.cnf
fi

# patch lua-resty-events
sudo sed -i 's/log(ERR, "event worker failed: ", perr)/log(ngx.WARN, "event worker failed: ", perr)/' /usr/local/openresty/lualib/resty/events/worker.lua
sed -i 's/log(ERR, "event worker failed: ", perr)/log(ngx.WARN, "event worker failed: ", perr)/' /usr/local/openresty/lualib/resty/events/worker.lua
18 changes: 11 additions & 7 deletions ci/redhat-ci.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,11 @@ install_dependencies() {

# install build & runtime deps
yum install -y --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms \
wget tar gcc automake autoconf libtool make unzip git sudo openldap-devel hostname \
which ca-certificates openssl-devel
wget tar gcc gcc-c++ automake autoconf libtool make unzip git sudo openldap-devel hostname patch \
which ca-certificates pcre pcre-devel xz \
openssl-devel

yum install -y --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms cpanminus perl

# install newer curl
yum makecache
Expand All @@ -34,14 +37,16 @@ install_dependencies() {
# install apisix-runtime to make apisix's rpm test work
yum install -y yum-utils && yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo
rpm --import https://repos.apiseven.com/KEYS
yum install -y openresty-openssl111 openresty-openssl111-devel pcre pcre pcre-devel xz
yum -y install https://repos.apiseven.com/packages/centos/apache-apisix-repo-1.0-1.noarch.rpm

wget "https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/build-apisix-runtime-debug-centos7.sh"
export luajit_xcflags="-DLUAJIT_ASSERT -DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT -O0"
export debug_args=--with-debug

wget "https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/build-apisix-runtime.sh"
chmod +x build-apisix-runtime.sh
chmod +x build-apisix-runtime-debug-centos7.sh
./build-apisix-runtime-debug-centos7.sh
./build-apisix-runtime.sh latest
curl -o /usr/local/openresty/openssl3/ssl/openssl.cnf \
https://raw.githubusercontent.com/api7/apisix-build-tools/apisix-runtime/${APISIX_RUNTIME}/conf/openssl3/openssl.cnf

# patch lua-resty-events
sed -i 's/log(ERR, "event worker failed: ", perr)/log(ngx.WARN, "event worker failed: ", perr)/' /usr/local/openresty/lualib/resty/events/worker.lua
Expand All @@ -60,7 +65,6 @@ install_dependencies() {
install_brotli

# install test::nginx
yum install -y --disablerepo=* --enablerepo=ubi-8-appstream-rpms --enablerepo=ubi-8-baseos-rpms cpanminus perl
cpanm --notest Test::Nginx IPC::Run > build.log 2>&1 || (cat build.log && exit 1)

# add go1.15 binary to the path
Expand Down
2 changes: 1 addition & 1 deletion t/APISIX.pm
View file
Original file line number Diff line number Diff line change
Expand Up @@ -262,7 +262,7 @@ env ENABLE_ETCD_AUTH;
env APISIX_PROFILE;
env PATH; # for searching external plugin runner's binary
env TEST_NGINX_HTML_DIR;
env OPENSSL111_BIN;
env OPENSSL_BIN;
_EOC_


Expand Down
4 changes: 2 additions & 2 deletions t/cli/test_upstream_mtls.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -141,8 +141,8 @@ sleep 0.1

make stop

if ! grep -E 'self signed certificate' logs/error.log; then
echo "failed: should got 'self signed certificate' when ssl_trusted_certificate is wrong ca cert"
if ! grep -E 'self-signed certificate' logs/error.log; then
echo "failed: should got 'self-signed certificate' when ssl_trusted_certificate is wrong ca cert"
exit 1
fi

Expand Down
20 changes: 10 additions & 10 deletions t/node/ssl-protocols.t
View file
Original file line number Diff line number Diff line change
Expand Up @@ -21,11 +21,11 @@ log_level('info');
no_root_location();
no_shuffle();

my $openssl_bin = $ENV{OPENSSL111_BIN};
my $openssl_bin = $ENV{OPENSSL_BIN};
if (! -x $openssl_bin) {
$ENV{OPENSSL111_BIN} = '/usr/local/openresty/openssl111/bin/openssl';
if (! -x $ENV{OPENSSL111_BIN}) {
plan(skip_all => "openssl111 not installed");
$ENV{OPENSSL_BIN} = '/usr/local/openresty/openssl3/bin/openssl';
if (! -x $ENV{OPENSSL_BIN}) {
plan(skip_all => "openssl3 not installed");
}
}

Expand Down Expand Up @@ -128,7 +128,7 @@ passed
=== TEST 3: Successfully, access test.com with TLSv1.3
--- exec
echo -n "Q" | $OPENSSL111_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_3 2>&1 | cat
echo -n "Q" | $OPENSSL_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_3 2>&1 | cat
--- response_body eval
qr/Server certificate/
Expand All @@ -144,7 +144,7 @@ qr/TLSv1\.2 \(IN\), TLS handshake, Server hello(?s).*hello world/
=== TEST 5: Successfully, access test.com with TLSv1.1
--- exec
echo -n "Q" | $OPENSSL111_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_1 2>&1 | cat
echo -n "Q" | $OPENSSL_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_1 2>&1 | cat
--- response_body eval
qr/Server certificate/
Expand Down Expand Up @@ -219,7 +219,7 @@ GET /t
=== TEST 8: Successfully, access test.com with TLSv1.3
--- exec
echo -n "Q" | $OPENSSL111_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_3 2>&1 | cat
echo -n "Q" | $OPENSSL_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_3 2>&1 | cat
--- response_body eval
qr/Server certificate/
Expand All @@ -235,7 +235,7 @@ qr/TLSv1\.2 \(IN\), TLS handshake, Server hello(?s).*hello world/
=== TEST 10: Successfully, access test2.com with TLSv1.3
--- exec
echo -n "Q" | $OPENSSL111_BIN s_client -connect 127.0.0.1:1994 -servername test2.com -tls1_3 2>&1 | cat
echo -n "Q" | $OPENSSL_BIN s_client -connect 127.0.0.1:1994 -servername test2.com -tls1_3 2>&1 | cat
--- response_body eval
qr/Server certificate/
Expand Down Expand Up @@ -285,14 +285,14 @@ passed
=== TEST 13: Successfully, access test.com with TLSv1.1
--- exec
echo -n "Q" | $OPENSSL111_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_1 2>&1 | cat
echo -n "Q" | $OPENSSL_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_1 2>&1 | cat
--- response_body eval
qr/Server certificate/
=== TEST 14: Failed, access test.com with TLSv1.3
--- exec
echo -n "Q" | $OPENSSL111_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_3 2>&1 | cat
echo -n "Q" | $OPENSSL_BIN s_client -connect 127.0.0.1:1994 -servername test.com -tls1_3 2>&1 | cat
--- response_body eval
qr/tlsv1 alert/
8 changes: 4 additions & 4 deletions utils/linux-install-luarocks.sh
View file
Original file line number Diff line number Diff line change
Expand Up @@ -47,10 +47,10 @@ rm -rf luarocks-"$LUAROCKS_VER"

mkdir ~/.luarocks || true

# OpenResty 1.17.8 or higher version uses openssl111 as the openssl dirname.
OPENSSL_PREFIX=${OPENRESTY_PREFIX}/openssl
if [ -d ${OPENRESTY_PREFIX}/openssl111 ]; then
OPENSSL_PREFIX=${OPENRESTY_PREFIX}/openssl111
OPENSSL_PREFIX=${OPENRESTY_PREFIX}/openssl3
if [ ! -d ${OPENSSL_PREFIX} ]; then
echo "Error: ${OPENSSL_PREFIX} not found, please install openssl3 first."
exit 1
fi

FOUND_PATH=$(echo "${PATH}" | grep -oP '(?<=:|)/usr/local/bin(?=:|)') || true
Expand Down

0 comments on commit 538b964

Please sign in to comment.