Skip to content

Commit 055f1e6

Browse files
AlinsRanAlinsRan
authored
feat: support openssl3 (#357)
1 parent 4ff4171 commit 055f1e6

9 files changed

+480
-24
lines changed

‎.github/workflows/package-apisix-runtime-deb-ubuntu20.04.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
docker exec ubuntu20.04Instance bash -c "wget -O - https://openresty.org/package/pubkey.gpg | apt-key add -"
4444
docker exec ubuntu20.04Instance bash -c 'echo "deb http://openresty.org/package/ubuntu $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/openresty.list'
4545
docker exec ubuntu20.04Instance bash -c "DEBIAN_FRONTEND=noninteractive apt-get update"
46-
docker exec ubuntu20.04Instance bash -c "DEBIAN_FRONTEND=noninteractive apt-get -y install openresty-openssl111 openresty-pcre openresty-zlib"
46+
docker exec ubuntu20.04Instance bash -c "DEBIAN_FRONTEND=noninteractive apt-get -y install openresty-pcre openresty-zlib"
4747
4848
- name: install deb in container
4949
run: |

‎.github/workflows/package-apisix-runtime-rpm-el7.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
- name: install dependencies in container
3939
run: |
4040
docker exec centos7Instance bash -c "yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo"
41-
docker exec centos7Instance bash -c "yum -y install openresty-openssl111 openresty-pcre openresty-zlib"
41+
docker exec centos7Instance bash -c "yum -y install openresty-pcre openresty-zlib"
4242
4343
- name: install rpm in container
4444
run: |

‎.github/workflows/package-apisix-runtime-rpm-el8.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ jobs:
4545
4646
docker exec centos8Instance bash -c "dnf install -y yum-utils"
4747
docker exec centos8Instance bash -c "yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo"
48-
docker exec centos8Instance bash -c "yum -y install openresty-openssl111 openresty-pcre openresty-zlib"
48+
docker exec centos8Instance bash -c "yum -y install openresty-pcre openresty-zlib"
4949
5050
- name: install rpm in container
5151
run: |

‎.github/workflows/package-apisix-runtime-rpm-ubi.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ jobs:
3737
run: |
3838
docker exec ubiInstance bash -c "dnf install -y yum-utils"
3939
docker exec ubiInstance bash -c "yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo"
40-
docker exec ubiInstance bash -c "yum -y install openresty-openssl111 openresty-pcre openresty-zlib"
40+
docker exec ubiInstance bash -c "yum -y install openresty-pcre openresty-zlib"
4141
4242
- name: install rpm in container
4343
run: |

‎build-apisix-runtime-debug-centos7.sh‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,9 +4,9 @@ set -x
44

55
yum-config-manager --add-repo https://openresty.org/package/centos/openresty.repo
66
yum -y install gcc gcc-c++ patch wget git make sudo
7-
yum -y install openresty-openssl111-devel openresty-pcre-devel openresty-zlib-devel
7+
yum -y install openresty-pcre-devel openresty-zlib-devel
88

9-
export openssl_prefix=/usr/local/openresty/openssl111
9+
export openssl_prefix=/usr/local/openresty/openssl3
1010
export zlib_prefix=/usr/local/openresty/zlib
1111
export pcre_prefix=/usr/local/openresty/pcre
1212

‎build-apisix-runtime.sh‎

Lines changed: 57 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,23 @@ set -x
44

55
runtime_version=${runtime_version:-0.0.0}
66

7+
8+
debug_args=${debug_args:-}
9+
ENABLE_FIPS=${ENABLE_FIPS:-"false"}
10+
OPENSSL_CONF_PATH=${OPENSSL_CONF_PATH:-$PWD/conf/openssl3/openssl.cnf}
11+
12+
13+
OR_PREFIX=${OR_PREFIX:="/usr/local/openresty"}
14+
OPENSSL_PREFIX=${OPENSSL_PREFIX:=$OR_PREFIX/openssl3}
15+
zlib_prefix=${OR_PREFIX}/zlib
16+
pcre_prefix=${OR_PREFIX}/pcre
17+
18+
cc_opt=${cc_opt:-"-DNGX_LUA_ABORT_AT_PANIC -I$zlib_prefix/include -I$pcre_prefix/include -I$OPENSSL_PREFIX/include"}
19+
ld_opt=${ld_opt:-"-L$zlib_prefix/lib -L$pcre_prefix/lib -L$OPENSSL_PREFIX/lib -Wl,-rpath,$zlib_prefix/lib:$pcre_prefix/lib:$OPENSSL_PREFIX/lib"}
20+
21+
22+
# dependencies for building openresty
23+
OPENSSL_VERSION=${OPENSSL_VERSION:-"3.2.0"}
724
OPENRESTY_VERSION="1.21.4.2"
825
ngx_multi_upstream_module_ver="1.1.1"
926
mod_dubbo_ver="1.0.2"
@@ -12,8 +29,41 @@ wasm_nginx_module_ver="0.6.5"
1229
lua_var_nginx_module_ver="v0.5.3"
1330
grpc_client_nginx_module_ver="v0.4.4"
1431
lua_resty_events_ver="0.2.0"
15-
OR_PREFIX=${OR_PREFIX:="/usr/local/openresty"}
16-
debug_args=${debug_args:-}
32+
33+
34+
install_openssl_3(){
35+
local fips=""
36+
if [ "$ENABLE_FIPS" == "true" ]; then
37+
fips="enable-fips"
38+
fi
39+
# required for openssl 3.x config
40+
cpanm IPC/Cmd.pm
41+
wget --no-check-certificate https://www.openssl.org/source/openssl-${OPENSSL_VERSION}.tar.gz
42+
tar xvf openssl-${OPENSSL_VERSION}.tar.gz
43+
cd openssl-${OPENSSL_VERSION}/
44+
export LDFLAGS="-Wl,-rpath,$zlib_prefix/lib:$OPENSSL_PREFIX/lib"
45+
./config $fips \
46+
shared \
47+
zlib \
48+
enable-camellia enable-seed enable-rfc3779 \
49+
enable-cms enable-md2 enable-rc5 \
50+
enable-weak-ssl-ciphers \
51+
--prefix=$OPENSSL_PREFIX \
52+
--libdir=lib \
53+
--with-zlib-lib=$zlib_prefix/lib \
54+
--with-zlib-include=$zlib_prefix/include
55+
make -j $(nproc) LD_LIBRARY_PATH= CC="gcc"
56+
make install
57+
if [ -f "$OPENSSL_CONF_PATH" ]; then
58+
cp "$OPENSSL_CONF_PATH" "$OPENSSL_PREFIX"/ssl/openssl.cnf
59+
fi
60+
if [ "$ENABLE_FIPS" == "true" ]; then
61+
$OPENSSL_PREFIX/bin/openssl fipsinstall -out $OPENSSL_PREFIX/ssl/fipsmodule.cnf -module $OPENSSL_PREFIX/lib/ossl-modules/fips.so
62+
sed -i 's@# .include fipsmodule.cnf@.include '"$OPENSSL_PREFIX"'/ssl/fipsmodule.cnf@g; s/# \(fips = fips_sect\)/\1\nbase = base_sect\n\n[base_sect]\nactivate=1\n/g' $OPENSSL_PREFIX/ssl/openssl.cnf
63+
fi
64+
cd ..
65+
}
66+
1767

1868
if ([ $# -gt 0 ] && [ "$1" == "latest" ]) || [ "$version" == "latest" ]; then
1969
debug_args="--with-debug"
@@ -24,6 +74,9 @@ repo=$(basename "$prev_workdir")
2474
workdir=$(mktemp -d)
2575
cd "$workdir" || exit 1
2676

77+
78+
install_openssl_3
79+
2780
wget --no-check-certificate https://openresty.org/download/openresty-${OPENRESTY_VERSION}.tar.gz
2881
tar -zxvpf openresty-${OPENRESTY_VERSION}.tar.gz > /dev/null
2982

@@ -95,8 +148,7 @@ cd wasm-nginx-module-${wasm_nginx_module_ver} || exit 1
95148
./install-wasmtime.sh
96149
cd ..
97150

98-
cc_opt=${cc_opt:-}
99-
ld_opt=${ld_opt:-}
151+
100152
luajit_xcflags=${luajit_xcflags:="-DLUAJIT_NUMMODE=2 -DLUAJIT_ENABLE_LUA52COMPAT"}
101153
no_pool_patch=${no_pool_patch:-}
102154
# TODO: remove old NGX_HTTP_GRPC_CLI_ENGINE_PATH once we have released a new
@@ -126,6 +178,7 @@ else
126178
mv lua-resty-limit-traffic-$limit_ver bundle/lua-resty-limit-traffic-$or_limit_ver
127179
fi
128180

181+
129182
./configure --prefix="$OR_PREFIX" \
130183
--with-cc-opt="-DAPISIX_RUNTIME_VER=$runtime_version $grpc_engine_path $cc_opt" \
131184
--with-ld-opt="-Wl,-rpath,$OR_PREFIX/wasmtime-c-api/lib $ld_opt" \

0 commit comments

Comments
 (0)