-
Notifications
You must be signed in to change notification settings - Fork 43
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
refactor(*) BREAKING: drop OpenSSL 1.0.2, 1.1.0 and BoringSSL support
- Loading branch information
Showing
52 changed files
with
349 additions
and
1,750 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,8 +1,8 @@ | ||
| # lua-resty-openssl | ||
|
|
||
| FFI-based OpenSSL binding for LuaJIT, supporting OpenSSL 3.1, 3.0, 1.1 and 1.0.2 series. | ||
| FFI-based OpenSSL binding for LuaJIT, supporting OpenSSL 3.x, 1.1 series. | ||
|
|
||
| BoringSSL is also supported. | ||
| OpenSSL 1.1.0, 1.0.2 and BoringSSL support has been dropped, but are still available at the [0.x branch](https://github.com/fffonion/lua-resty-openssl/tree/0.x). | ||
|
|
||
|    | ||
|
|
||
|
|
@@ -35,8 +35,7 @@ Table of Contents | |
| + [version.version](#versionversion) | ||
| + [version.info](#versioninfo) | ||
| + [version.OPENSSL_3X](#versionOPENSSL_3X) | ||
| + [version.OPENSSL_11](#versionopenssl_11) | ||
| + [version.OPENSSL_10](#versionopenssl_10) | ||
| + [version.OPENSSL_111](#versionopenssl_111) | ||
| * [resty.openssl.provider](#restyopensslprovider) | ||
| + [provider.load](#providerload) | ||
| + [provider.istype](#provideristype) | ||
|
|
@@ -295,10 +294,7 @@ Description | |
| =========== | ||
|
|
||
| `lua-resty-openssl` is a FFI-based OpenSSL binding library, currently | ||
| supports OpenSSL `3.1.x`, `3.0.x`, `1.1.1`, `1.1.0` and `1.0.2` series. | ||
|
|
||
| **Note: when using with OpenSSL 1.0.2, it's recommanded to not use this library with other FFI-based OpenSSL binding libraries to avoid potential mismatch of `cdef`.** | ||
|
|
||
| supports OpenSSL `3.x` and `1.1.1` series. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
|
|
@@ -321,9 +317,6 @@ using `error()` but instead return as last parameter. | |
| Each Lua table returned by `new()` contains a cdata object `ctx`. User are not supposed to manully setting | ||
| `ffi.gc` or calling corresponding destructor of the `ctx` struct (like `*_free` functions). | ||
|
|
||
| BoringSSL removes some algorithms and not all functionalities below is supported by BoringSSL. Please | ||
| consul its manual for differences between OpenSSL API. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ## resty.openssl | ||
|
|
@@ -443,7 +436,6 @@ print(c:get_provider_name()) -- prints "fips" | |
| Compile the module per [security policy](https://csrc.nist.gov/CSRC/media/projects/cryptographic-module-validation-program/documents/security-policies/140sp3678.pdf) | ||
|
|
||
| Check if FIPS is acticated by running `assert(openssl.set_fips_mode(true))`. | ||
| BoringSSL doesn't support "turn FIPS mode off" once it's compiled. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
|
|
@@ -596,11 +588,6 @@ Returns various OpenSSL version information. Available values for `types` are: | |
| MODULES_DIR | ||
| CPU_INFO | ||
|
|
||
| For OpenSSL prior to 1.1.x, only `VERSION`, `CFLAGS`, `BUILT_ON`, `PLATFORM` | ||
| and `DIR` are supported. Please refer to | ||
| [OPENSSL_VERSION_NUMBER(3)](https://www.openssl.org/docs/manmaster/man3/OPENSSL_VERSION_NUMBER.html) | ||
| for explanation of each type. | ||
|
|
||
| ```lua | ||
| local version = require("resty.openssl.version") | ||
| ngx.say(string.format("%x", version.version_num)) | ||
|
|
@@ -647,23 +634,9 @@ A boolean indicates whether the linked OpenSSL is 3.x series. | |
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ### version.OPENSSL_30 | ||
|
|
||
| Deprecated: use `version.OPENSSL_3X` is encouraged. | ||
|
|
||
| A boolean indicates whether the linked OpenSSL is 3.0 series. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ### version.OPENSSL_11 | ||
| ### version.OPENSSL_111 | ||
|
|
||
| A boolean indicates whether the linked OpenSSL is 1.1 series. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ### version.OPENSSL_10 | ||
|
|
||
| A boolean indicates whether the linked OpenSSL is 1.0 series. | ||
| A boolean indicates whether the linked OpenSSL is 1.1.1 series. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
|
|
@@ -767,10 +740,6 @@ X25519 | Y | Y | | | Y (ECDH) | | |
| Ed448 | Y | Y | | Y (PureEdDSA) | | | ||
| X448 | Y | Y | | | Y (ECDH) | | ||
|
|
||
| `Ed25519`, `X25519`, `Ed448` and `X448` keys are only supported since OpenSSL 1.1.0. | ||
|
|
||
| Note BoringSSL doesn't support `Ed448` and `X448` keys. | ||
|
|
||
| Direct support of encryption and decryption for EC and ECX does not exist, but | ||
| processes like ECIES is possible with [pkey:derive](#pkeyderive), | ||
| [kdf](#restyopensslkdf) and [cipher](#restyopensslcipher) | ||
|
|
@@ -1067,8 +1036,7 @@ This mode only supports RSA and EC keys. | |
| When passing a string as first parameter, `md_alg` parameter will specify the name | ||
| to use when signing. When `md_alg` is undefined, for RSA and EC keys, this function does SHA256 | ||
| by default. For Ed25519 or Ed448 keys, this function does a PureEdDSA signing, | ||
| no message digest should be specified and will not be used. BoringSSL doesn't have default | ||
| digest thus `md_alg` must be specified. | ||
| no message digest should be specified and will not be used. | ||
|
|
||
| `opts` is a table that accepts additional parameters. | ||
|
|
||
|
|
@@ -1083,8 +1051,7 @@ obsolete MD5 hash algorithm and will return error on this combination. See | |
| for a list of algorithms and associated public key algorithms. Normally, the ECDSA signature | ||
| is encoded in ASN.1 DER format. If the `opts` table contains a `ecdsa_use_raw` field with | ||
| a true value, a binary with just the concatenation of binary representation `pr` and `ps` is returned. | ||
| This is useful for example to send the signature as JWS. This feature | ||
| is only supported on OpenSSL 1.1.0 or later. | ||
| This is useful for example to send the signature as JWS. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
|
|
@@ -1106,8 +1073,7 @@ This mode only supports RSA and EC keys. | |
| When passing a string as second parameter, `md_alg` parameter will specify the name | ||
| to use when verifying. When `md_alg` is undefined, for RSA and EC keys, this function does SHA256 | ||
| by default. For Ed25519 or Ed448 keys, this function does a PureEdDSA verification, | ||
| no message digest should be specified and will not be used. BoringSSL doesn't have default | ||
| digest thus `md_alg` must be specified. | ||
| no message digest should be specified and will not be used. | ||
|
|
||
| `opts` is a table that accepts additional parameters. | ||
|
|
||
|
|
@@ -1118,8 +1084,7 @@ possible to specify PSS salt length by setting `opts.pss_saltlen`. | |
| For EC key, this function does a ECDSA verification. Normally, the ECDSA signature | ||
| should be encoded in ASN.1 DER format. If the `opts` table contains a `ecdsa_use_raw` field with | ||
| a true value, this library treat `signature` as concatenation of binary representation `pr` and `ps`. | ||
| This is useful for example to verify the signature as JWS. This feature | ||
| is only supported on OpenSSL 1.1.0 or later. | ||
| This is useful for example to verify the signature as JWS. | ||
|
|
||
| ```lua | ||
| -- RSA and EC keys | ||
|
|
@@ -1313,8 +1278,7 @@ Creates a `bn` instance from binary string. | |
| Exports the BIGNUM value in binary string. | ||
|
|
||
| `bn:to_binary` accepts an optional number argument `padto` that can be | ||
| used to pad leading zeros to the output to a specific length. This feature | ||
| is only supported on OpenSSL 1.1.0 or later. | ||
| used to pad leading zeros to the output to a specific length. | ||
|
|
||
| ```lua | ||
| local b, err = require("resty.openssl.bn").from_binary(ngx.decode_base64("WyU=")) | ||
|
|
@@ -2030,8 +1994,7 @@ instead. | |
|
|
||
| Derive a key from given material. Various KDFs are supported based on OpenSSL version: | ||
|
|
||
| - On OpenSSL 1.0.2 and later, `PBKDF2`([RFC 2898], [NIST SP 800-132]) is available. | ||
| - On OpenSSL 1.1.0 and later, `HKDF`([RFC 5869]), `TLS1-PRF`([RFC 2246], [RFC 5246] and [NIST SP 800-135 r1]) and `scrypt`([RFC 7914]) is available. | ||
| `PBKDF2`([RFC 2898], [NIST SP 800-132]), `HKDF`([RFC 5869]), `TLS1-PRF`([RFC 2246], [RFC 5246] and [NIST SP 800-135 r1]) and `scrypt`([RFC 7914]) is available. | ||
|
|
||
|
|
||
| `options` is a table that contains: | ||
|
|
@@ -2047,7 +2010,7 @@ Derive a key from given material. Various KDFs are supported based on OpenSSL ve | |
| to explictly select provider to fetch algorithms. | | | ||
| | pbkdf2_iter | number | PBKDF2 iteration count. RFC 2898 suggests an iteration count of at least 1000. Any value less than 1 is treated as a single iteration. | `1` | | ||
| | hkdf_key | string | HKDF key | **required** | | ||
| | hkdf_mode | number | HKDF mode to use, one of `kdf.HKDEF_MODE_EXTRACT_AND_EXPAND`, `kdf.HKDEF_MODE_EXTRACT_ONLY` or `kdf.HKDEF_MODE_EXPAND_ONLY`. This is only effective with OpenSSL >= 1.1.1. To learn about mode, please refer to [EVP_PKEY_CTX_set1_hkdf_key(3)](https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_CTX_set1_hkdf_key.html). Note with `kdf.HKDEF_MODE_EXTRACT_ONLY`, `outlen` is ignored and the output will be fixed size of `HMAC-<md>`. | `kdf.HKDEF_MODE_EXTRACT_AND_EXPAND`| | ||
| | hkdf_mode | number | HKDF mode to use, one of `kdf.HKDEF_MODE_EXTRACT_AND_EXPAND`, `kdf.HKDEF_MODE_EXTRACT_ONLY` or `kdf.HKDEF_MODE_EXPAND_ONLY`. To learn about mode, please refer to [EVP_PKEY_CTX_set1_hkdf_key(3)](https://www.openssl.org/docs/manmaster/man3/EVP_PKEY_CTX_set1_hkdf_key.html). Note with `kdf.HKDEF_MODE_EXTRACT_ONLY`, `outlen` is ignored and the output will be fixed size of `HMAC-<md>`. | `kdf.HKDEF_MODE_EXTRACT_AND_EXPAND`| | ||
| | hkdf_info | string | HKDF info value | (empty string) | | ||
| | tls1_prf_secret | string | TLS1-PRF secret | **required** | | ||
| | tls1_prf_seed | string | TLS1-PRF seed | **required** | | ||
|
|
@@ -2592,8 +2555,6 @@ Sign the certificate using the private key specified by `pkey`, which must be a | |
| parameter to set digest method, whichmust be a [resty.openssl.digest](#restyopenssldigest) instance. | ||
| Returns a boolean indicating if signing is successful and error if any. | ||
|
|
||
| In BoringSSL when `digest` is not set it's fallback to `SHA256`. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ### x509:verify | ||
|
|
@@ -2804,8 +2765,6 @@ Sign the certificate request using the private key specified by `pkey`, which mu | |
| parameter to set digest method, whichmust be a [resty.openssl.digest](#restyopenssldigest) instance. | ||
| Returns a boolean indicating if signing is successful and error if any. | ||
|
|
||
| In BoringSSL when `digest` is not set it's fallback to `SHA256`. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ### csr:verify | ||
|
|
@@ -3020,8 +2979,6 @@ Sign the CRL using the private key specified by `pkey`, which must be a | |
| parameter to set digest method, whichmust be a [resty.openssl.digest](#restyopenssldigest) instance. | ||
| Returns a boolean indicating if signing is successful and error if any. | ||
|
|
||
| In BoringSSL when `digest` is not set it's fallback to `SHA256`. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ### crl:verify | ||
|
|
@@ -3973,8 +3930,6 @@ to explictly select provider to fetch algorithms. | |
| Returns `true` when the certificate isn't revoked, | ||
| otherwise returns `nil` and error explaining the reason. | ||
|
|
||
| Note this function is supported from OpenSSL 1.1.0 and not supported in BoringSSL. | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
| ## resty.openssl.x509.revoked | ||
|
|
@@ -4539,7 +4494,7 @@ Copyright and License | |
|
|
||
| This module is licensed under the BSD license. | ||
|
|
||
| Copyright (C) 2019-2020, by fffonion <[email protected]>. | ||
| Copyright (C) 2019-2023, by fffonion <[email protected]>. | ||
|
|
||
| All rights reserved. | ||
|
|
||
|
|
@@ -4557,7 +4512,7 @@ See Also | |
| ======== | ||
| * [luaossl](https://github.com/wahern/luaossl) | ||
| * [API/ABI changes review for OpenSSL](https://abi-laboratory.pro/index.php?view=timeline&l=openssl) | ||
| * [OpenSSL API manual](https://www.openssl.org/docs/man1.1.1/man3/) | ||
| * [OpenSSL API manual](https://www.openssl.org/docs/man3.1/man3/) | ||
|
|
||
| [Back to TOC](#table-of-contents) | ||
|
|
||
|
|
||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.