Skip to content

Commit a5571f7

Browse files
spacewanderspacewander
authored
feat: add GM C API set cert/priv_key (#67)
1 parent 1af1ee4 commit a5571f7

File tree

15 files changed

+505
-0
lines changed

15 files changed

+505
-0
lines changed

‎.github/workflows/gm.yml‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
name: Test GM SSL
2+
3+
on:
4+
push:
5+
branches: [ main ]
6+
pull_request:
7+
branches: [ main ]
8+
9+
jobs:
10+
build:
11+
runs-on: "ubuntu-latest"
12+
env:
13+
OPENRESTY_PREFIX: "/usr/local/openresty"
14+
15+
steps:
16+
- name: Check out code
17+
uses: actions/checkout@v2
18+
19+
- name: Set up Clang
20+
uses: egor-tensin/setup-clang@v1
21+
22+
- name: Get dependencies
23+
run: sudo apt install -y cpanminus build-essential libncurses5-dev libreadline-dev libssl-dev perl
24+
25+
- name: Before install
26+
run: |
27+
sudo cpanm --notest Test::Nginx > build.log 2>&1 || (cat build.log && exit 1)
28+
git clone https://github.com/iresty/test-nginx.git test-nginx
29+
30+
- name: Install SSL lib
31+
run: |
32+
# TODO: use a fixed release once they have created one.
33+
# See https://github.com/Tongsuo-Project/Tongsuo/issues/318
34+
git clone https://github.com/api7/tongsuo --depth 1
35+
pushd tongsuo
36+
./config shared enable-ntls -g --prefix=/usr/local/tongsuo
37+
make -j2
38+
sudo make install_sw
39+
# build binary
40+
./config enable-ntls -static
41+
make -j2
42+
mv apps/openssl ..
43+
popd
44+
45+
- name: Install
46+
run: |
47+
ls /usr/local/tongsuo/lib64
48+
wget https://raw.githubusercontent.com/api7/apisix-build-tools/master/build-apisix-base.sh
49+
chmod +x build-apisix-base.sh
50+
export openssl_prefix=/usr/local/tongsuo
51+
52+
export cc_opt="-I${openssl_prefix}/include -Werror"
53+
export ld_opt="-L${openssl_prefix}/lib64 -Wl,-rpath,${openssl_prefix}/lib64"
54+
OR_PREFIX=$OPENRESTY_PREFIX CC="clang -fsanitize=address -fcolor-diagnostics -Qunused-arguments" \
55+
./build-apisix-base.sh latest
56+
57+
- name: Script
58+
run: |
59+
export PATH=$OPENRESTY_PREFIX/nginx/sbin:$PATH
60+
nginx -V
61+
PATH=$PWD:$PATH prove -I. -Itest-nginx/lib -r t/gm.t

‎.gitignore‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
t/servroot
2+
/openssl

‎lib/resty/apisix/ssl.lua‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
local ffi = require("ffi")
2+
local base = require("resty.core.base")
3+
local errmsg = base.get_errmsg_ptr()
4+
local get_request = base.get_request
5+
local FFI_OK = base.FFI_OK
6+
local C = ffi.C
7+
local ffi_str = ffi.string
8+
9+
10+
base.allows_subsystem("http")
11+
12+
13+
ffi.cdef[[
14+
typedef intptr_t ngx_flag_t;
15+
int ngx_http_apisix_set_gm_cert(void *r, void *cdata, char **err, ngx_flag_t type);
16+
int ngx_http_apisix_set_gm_priv_key(void *r, void *cdata, char **err, ngx_flag_t type);
17+
]]
18+
19+
20+
local NGX_HTTP_APISIX_SSL_ENC = 1
21+
local NGX_HTTP_APISIX_SSL_SIGN = 2
22+
local _M = {}
23+
24+
25+
function _M.set_gm_cert(enc_cert, sign_cert)
26+
local r = get_request()
27+
if not r then
28+
error("no request found")
29+
end
30+
31+
local rc = C.ngx_http_apisix_set_gm_cert(r, enc_cert, errmsg, NGX_HTTP_APISIX_SSL_ENC)
32+
if rc ~= FFI_OK then
33+
return nil, ffi_str(errmsg[0])
34+
end
35+
36+
local rc = C.ngx_http_apisix_set_gm_cert(r, sign_cert, errmsg, NGX_HTTP_APISIX_SSL_SIGN)
37+
if rc ~= FFI_OK then
38+
return nil, ffi_str(errmsg[0])
39+
end
40+
41+
return true
42+
end
43+
44+
45+
function _M.set_gm_priv_key(enc_pkey, sign_pkey)
46+
local r = get_request()
47+
if not r then
48+
error("no request found")
49+
end
50+
51+
local rc = C.ngx_http_apisix_set_gm_priv_key(r, enc_pkey, errmsg, NGX_HTTP_APISIX_SSL_ENC)
52+
if rc ~= FFI_OK then
53+
return nil, ffi_str(errmsg[0])
54+
end
55+
56+
local rc = C.ngx_http_apisix_set_gm_priv_key(r, sign_pkey, errmsg, NGX_HTTP_APISIX_SSL_SIGN)
57+
if rc ~= FFI_OK then
58+
return nil, ffi_str(errmsg[0])
59+
end
60+
61+
return true
62+
end
63+
64+
65+
return _M

‎patch/1.21.4/nginx-enable_ntls.patch‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
diff --git src/http/ngx_http_request.c src/http/ngx_http_request.c
2+
index 013b715..a729693 100644
3+
--- src/http/ngx_http_request.c
4+
+++ src/http/ngx_http_request.c
5+
@@ -754,6 +754,11 @@ ngx_http_ssl_handshake(ngx_event_t *rev)
6+
return;
7+
}
8+
9+
+#if (TONGSUO_VERSION_NUMBER && NGX_HTTP_APISIX)
10+
+ // FIXME: add option later
11+
+ SSL_enable_ntls(c->ssl->connection);
12+
+#endif
13+
+
14+
ngx_reusable_connection(c, 0);
15+
16+
rc = ngx_ssl_handshake(c);

‎src/ngx_http_apisix_module.c‎

Lines changed: 138 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,10 @@
55
#include "ngx_http_apisix_module.h"
66

77

8+
#define NGX_HTTP_APISIX_SSL_ENC 1
9+
#define NGX_HTTP_APISIX_SSL_SIGN 2
10+
11+
812
static ngx_str_t remote_addr = ngx_string("remote_addr");
913
static ngx_str_t remote_port = ngx_string("remote_port");
1014
static ngx_str_t realip_remote_addr = ngx_string("realip_remote_addr");
@@ -640,3 +644,137 @@ ngx_http_apisix_is_body_filter_by_lua_skipped(ngx_http_request_t *r)
640644

641645
return 0;
642646
}
647+
648+
649+
int
650+
ngx_http_apisix_set_gm_cert(ngx_http_request_t *r, void *cdata, char **err, ngx_flag_t type)
651+
{
652+
#ifndef TONGSUO_VERSION_NUMBER
653+
654+
*err = "only Tongsuo supported";
655+
return NGX_ERROR;
656+
657+
#else
658+
int i;
659+
X509 *x509 = NULL;
660+
ngx_ssl_conn_t *ssl_conn;
661+
STACK_OF(X509) *chain = cdata;
662+
663+
if (r->connection == NULL || r->connection->ssl == NULL) {
664+
*err = "bad request";
665+
return NGX_ERROR;
666+
}
667+
668+
ssl_conn = r->connection->ssl->connection;
669+
if (ssl_conn == NULL) {
670+
*err = "bad ssl conn";
671+
return NGX_ERROR;
672+
}
673+
674+
if (sk_X509_num(chain) < 1) {
675+
*err = "invalid certificate chain";
676+
goto failed;
677+
}
678+
679+
x509 = sk_X509_value(chain, 0);
680+
if (x509 == NULL) {
681+
*err = "sk_X509_value() failed";
682+
goto failed;
683+
}
684+
685+
if (type == NGX_HTTP_APISIX_SSL_ENC) {
686+
if (SSL_use_enc_certificate(ssl_conn, x509) == 0) {
687+
*err = "SSL_use_enc_certificate() failed";
688+
goto failed;
689+
}
690+
} else {
691+
if (SSL_use_sign_certificate(ssl_conn, x509) == 0) {
692+
*err = "SSL_use_sign_certificate() failed";
693+
goto failed;
694+
}
695+
}
696+
697+
x509 = NULL;
698+
699+
/* read rest of the chain */
700+
701+
for (i = 1; i < sk_X509_num(chain); i++) {
702+
703+
x509 = sk_X509_value(chain, i);
704+
if (x509 == NULL) {
705+
*err = "sk_X509_value() failed";
706+
goto failed;
707+
}
708+
709+
if (SSL_add1_chain_cert(ssl_conn, x509) == 0) {
710+
*err = "SSL_add1_chain_cert() failed";
711+
goto failed;
712+
}
713+
}
714+
715+
*err = NULL;
716+
return NGX_OK;
717+
718+
failed:
719+
720+
ERR_clear_error();
721+
722+
return NGX_ERROR;
723+
724+
#endif
725+
}
726+
727+
728+
int
729+
ngx_http_apisix_set_gm_priv_key(ngx_http_request_t *r,
730+
void *cdata, char **err, ngx_flag_t type)
731+
{
732+
#ifndef TONGSUO_VERSION_NUMBER
733+
734+
*err = "only Tongsuo supported";
735+
return NGX_ERROR;
736+
737+
#else
738+
739+
EVP_PKEY *pkey = NULL;
740+
ngx_ssl_conn_t *ssl_conn;
741+
742+
if (r->connection == NULL || r->connection->ssl == NULL) {
743+
*err = "bad request";
744+
return NGX_ERROR;
745+
}
746+
747+
ssl_conn = r->connection->ssl->connection;
748+
if (ssl_conn == NULL) {
749+
*err = "bad ssl conn";
750+
return NGX_ERROR;
751+
}
752+
753+
pkey = cdata;
754+
if (pkey == NULL) {
755+
*err = "invalid private key failed";
756+
goto failed;
757+
}
758+
759+
if (type == NGX_HTTP_APISIX_SSL_ENC) {
760+
if (SSL_use_enc_PrivateKey(ssl_conn, pkey) == 0) {
761+
*err = "SSL_use_enc_PrivateKey() failed";
762+
goto failed;
763+
}
764+
} else {
765+
if (SSL_use_sign_PrivateKey(ssl_conn, pkey) == 0) {
766+
*err = "SSL_use_sign_PrivateKey() failed";
767+
goto failed;
768+
}
769+
}
770+
771+
return NGX_OK;
772+
773+
failed:
774+
775+
ERR_clear_error();
776+
777+
return NGX_ERROR;
778+
779+
#endif
780+
}

‎t/certs/client_enc.crt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB2TCCAX6gAwIBAgIBBTAKBggqgRzPVQGDdTBFMQswCQYDVQQGEwJBQTELMAkG
3+
A1UECAwCQkIxCzAJBgNVBAoMAkNDMQswCQYDVQQLDAJERDEPMA0GA1UEAwwGc3Vi
4+
IGNhMB4XDTIyMTEwMjAzMTkzNloXDTMyMTAzMDAzMTkzNlowSTELMAkGA1UEBhMC
5+
QUExCzAJBgNVBAgMAkJCMQswCQYDVQQKDAJDQzELMAkGA1UECwwCREQxEzARBgNV
6+
BAMMCmNsaWVudCBlbmMwWjAUBggqgRzPVQGCLQYIKoEcz1UBgi0DQgAEYYuPPz5e
7+
0QMSGPeBfVbK02GwYhSieSCuc12WsNw+ZQEiaN3NJ2Mh0EAH95eWVutKAeMwKwQZ
8+
q7QgnSoo3io8hKNaMFgwCQYDVR0TBAIwADALBgNVHQ8EBAMCAzgwHQYDVR0OBBYE
9+
FEL0AwvahirH+kdK5Poq+e0yhii1MB8GA1UdIwQYMBaAFCTrpmbUig3JfveqAIGJ
10+
6n+vAk2AMAoGCCqBHM9VAYN1A0kAMEYCIQDx+KxdaJ7YX5gR492EgiGn7//HsjOU
11+
B7+jyTVvkNzN2AIhAIbDKNJQ2i5Edcw/nDIWJQLec7NZui3QfC/gr9AuCfHN
12+
-----END CERTIFICATE-----

‎t/certs/client_enc.key‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgq7+Y1ql10Uvv2vTf
3+
AHR26o4B3RJTJO5XTh0BNLdtB7OhRANCAARhi48/Pl7RAxIY94F9VsrTYbBiFKJ5
4+
IK5zXZaw3D5lASJo3c0nYyHQQAf3l5ZW60oB4zArBBmrtCCdKijeKjyE
5+
-----END PRIVATE KEY-----

‎t/certs/client_sign.crt‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB2TCCAX+gAwIBAgIBBDAKBggqgRzPVQGDdTBFMQswCQYDVQQGEwJBQTELMAkG
3+
A1UECAwCQkIxCzAJBgNVBAoMAkNDMQswCQYDVQQLDAJERDEPMA0GA1UEAwwGc3Vi
4+
IGNhMB4XDTIyMTEwMjAzMTkzNloXDTMyMTAzMDAzMTkzNlowSjELMAkGA1UEBhMC
5+
QUExCzAJBgNVBAgMAkJCMQswCQYDVQQKDAJDQzELMAkGA1UECwwCREQxFDASBgNV
6+
BAMMC2NsaWVudCBzaWduMFowFAYIKoEcz1UBgi0GCCqBHM9VAYItA0IABFZcc94m
7+
hTZRKis639AnlAbS0cKQv73GP5RzBdNlLpAaUwi4hqAh0ZUIcTH/5ZbOTal9MvHA
8+
gOLjVxv197o+fNejWjBYMAkGA1UdEwQCMAAwCwYDVR0PBAQDAgbAMB0GA1UdDgQW
9+
BBTkdzyphRCxqD6m6j/AUhMSEBASRDAfBgNVHSMEGDAWgBQk66Zm1IoNyX73qgCB
10+
iep/rwJNgDAKBggqgRzPVQGDdQNIADBFAiB2rcm1UI84yPYT5q6vjucBNPw01cHM
11+
3/Hc9fhiuYPyHwIhAIiPPPj4XI2l98C+DBaqoZtSiwDK2IA6Q8lf9SmHdFPN
12+
-----END CERTIFICATE-----

‎t/certs/client_sign.key‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
-----BEGIN PRIVATE KEY-----
2+
MIGHAgEAMBMGByqGSM49AgEGCCqBHM9VAYItBG0wawIBAQQgIsAr+s4TL7K4AQWO
3+
PbXrJfHoO5yE2V7oYQxUBsieOQOhRANCAARWXHPeJoU2USorOt/QJ5QG0tHCkL+9
4+
xj+UcwXTZS6QGlMIuIagIdGVCHEx/+WWzk2pfTLxwIDi41cb9fe6PnzX
5+
-----END PRIVATE KEY-----

‎t/certs/gm_ca.crt‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIB3zCCAYWgAwIBAgIBADAKBggqgRzPVQGDdTBGMQswCQYDVQQGEwJBQTELMAkG
3+
A1UECAwCQkIxCzAJBgNVBAoMAkNDMQswCQYDVQQLDAJERDEQMA4GA1UEAwwHcm9v
4+
dCBjYTAeFw0yMjExMDIwMzE5MzZaFw0zMjEwMzAwMzE5MzZaMEYxCzAJBgNVBAYT
5+
AkFBMQswCQYDVQQIDAJCQjELMAkGA1UECgwCQ0MxCzAJBgNVBAsMAkREMRAwDgYD
6+
VQQDDAdyb290IGNhMFowFAYIKoEcz1UBgi0GCCqBHM9VAYItA0IABB+V1+bwQsP4
7+
IMZEVCu3LSekz9SIhxWVVtlqdQYZG55S46PmAqICzrO3KFJ/IPtMx9wKn3L6V5M8
8+
hAc/UwOAnKCjYzBhMB0GA1UdDgQWBBRV7bTJ6vT1fliZR42/+E+fEBfTSjAfBgNV
9+
HSMEGDAWgBRV7bTJ6vT1fliZR42/+E+fEBfTSjAPBgNVHRMBAf8EBTADAQH/MA4G
10+
A1UdDwEB/wQEAwIBhjAKBggqgRzPVQGDdQNIADBFAiEA1SGACV1wj158Spgh+HOW
11+
oOr7rTO2fR4cK9Zx7eUvmAECIHbKbsw5szaC/EH7CdsHdFgrj2tWaXiQUnx/rxM/
12+
upAQ
13+
-----END CERTIFICATE-----
14+
-----BEGIN CERTIFICATE-----
15+
MIIB4TCCAYegAwIBAgIBATAKBggqgRzPVQGDdTBGMQswCQYDVQQGEwJBQTELMAkG
16+
A1UECAwCQkIxCzAJBgNVBAoMAkNDMQswCQYDVQQLDAJERDEQMA4GA1UEAwwHcm9v
17+
dCBjYTAeFw0yMjExMDIwMzE5MzZaFw0zMjEwMzAwMzE5MzZaMEUxCzAJBgNVBAYT
18+
AkFBMQswCQYDVQQIDAJCQjELMAkGA1UECgwCQ0MxCzAJBgNVBAsMAkREMQ8wDQYD
19+
VQQDDAZzdWIgY2EwWjAUBggqgRzPVQGCLQYIKoEcz1UBgi0DQgAElA5ey1dYWNkT
20+
zfvwcKEhX1vHL+Kjil+egM6QssbNrts2S0M07L77XDe1q2zPpHjo0MR05x862/tZ
21+
j87OgmEE0KNmMGQwHQYDVR0OBBYEFCTrpmbUig3JfveqAIGJ6n+vAk2AMB8GA1Ud
22+
IwQYMBaAFFXttMnq9PV+WJlHjb/4T58QF9NKMBIGA1UdEwEB/wQIMAYBAf8CAQAw
23+
DgYDVR0PAQH/BAQDAgGGMAoGCCqBHM9VAYN1A0gAMEUCIArKNHWYLmd3thQmJv89
24+
o0wr6O2q26WJuy6y7Eu14rdFAiEA7XNZ0JGMXPKiG5Hl7nmL8ooTrVhrmRrvs9No
25+
Y8rH88Y=
26+
-----END CERTIFICATE-----

0 commit comments

Comments
 (0)