mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
dacd8ee72b
Fixes needed by the OSP OpenResty 1.31.1.1 port, plus a workflow that runs the bundled SSL tests against wolfSSL. d2i_X509_bio(): read one DER object per call, as OpenSSL does. ngx_lua's set_der_cert() decodes a chain from one BIO one certificate at a time. MAX_EX_DATA: default to 10 slots for --enable-nginx unless --enable-context-extra-user-data gives a number. nginx 1.31 allocates six SSL_CTX ex_data indexes and the OpenResty Lua modules use five SSL ones. wolfSSL_OCSP_resp_find_status() and wolfSSL_OCSP_single_get0_status(): return NULL for an absent thisUpdate or nextUpdate instead of a pointer to a zeroed WOLFSSL_ASN1_TIME. ngx.ocsp.validate_ocsp_response() failed with "invalid nextUpdate time" for responses without nextUpdate. Session cache: with WOLFSSL_TICKET_HAVE_ID, DoClientTicketFinalize() called the external cache callback on every ticket resumption because useTicket is only set after DoClientTicket() returns. Add wolfSSL_GetSessionFromInternalCache() and use it unless the server accepts early data (maxEarlyDataSz > 0), where the external cache takes part in the 0-RTT anti-replay eviction. OpenSSL does the same: stateful tickets and a cache lookup only with max_early_data set. ngx_lua expects ssl_session_fetch_by_lua* to be skipped for ticket resumptions. .github/workflows/openresty.yml: build OpenResty 1.31.1.1 with the OSP port and tests patches against --enable-openresty and run the SSL test files of ngx_lua, ngx_stream_lua and lua-resty-core, plus the encrypted-session and set-misc suites, with Test::Nginx. Files that need APIs wolfSSL does not provide or the network are not run. The OSP checkout points at julek-dev/osp openresty-1.31.1.1 until the patches are merged into wolfSSL/osp. memcached is a new test dependency. Tests: d2i_X509_bio chain decoding, absent OCSP times, session cache callback counts with tickets and early data.