wolfSSL / wolfssl-nginx

Adds wolfSSL support to Nginx.
https://www.wolfssl.com
33 stars 13 forks source link

Add missing wolfSSL includes and alert history logging. #20

Closed kareem-wolfssl closed 2 years ago

kareem-wolfssl commented 2 years ago

Without the relevant settings header included, nginx's test program compilation will fail:

> ----------------------------------------
> checking for wolfSSL library in /usr/local
>
> In file included from /usr/local/include/wolfssl/ssl.h:33,
> from /usr/local/include/wolfssl/openssl/ssl.h:35,
> from objs/autotest.c:4:
> /usr/local/include/wolfssl/wolfcrypt/settings.h:2369:14: warning: #warning "For timing resistance / side-channel attack prevention consider using harden options" [-Wcpp]
> 2369 | #warning "For timing resistance / side-channel attack prevention consider using harden options"
> | ^~~~~~~
> objs/autotest.c: In function 'main':
> objs/autotest.c:7:5: warning: implicit declaration of function 'SSL_CTX_set_options'; did you mean 'wolfSSL_CTX_set_options'? [-Wimplicit-function-declaration]
> 7 | SSL_CTX_set_options(NULL, 0);
> | ^~~~~~~~~~~~~~~~~~~
> | wolfSSL_CTX_set_options
> /usr/bin/ld: /tmp/cc2WacIU.o: in function `main':
> autotest.c:(.text+0x18): undefined reference to `SSL_CTX_set_options'
> collect2: error: ld returned 1 exit status
> ----------
>
> #include <sys/types.h>
> #include <unistd.h>
> #include <openssl/ssl.h>
>
> int main(void) {
> SSL_CTX_set_options(NULL, 0);
> return 0;
> }
>
> ----------
> cc -D_GNU_SOURCE -D_FILE_OFFSET_BITS=64 -I /usr/local/include/wolfssl -I /usr/local/include -o objs/autotest objs/autotest.c -L/usr/local/lib -lwolfssl
> ----------
kareem-wolfssl commented 2 years ago

Added alert history logging. Example:

2022/07/01 12:08:01 [crit] 74236#0: *1 SSL_do_handshake() failed (RX alert: level=fatal,code=illegal_parameter, TX alert: level=none,code=none) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:1443
2022/07/01 12:08:01 [crit] 74236#0: *1 SSL_do_handshake() failed (SSL: received alert fatal error unknown error number) while SSL handshaking, client: 127.0.0.1, server: 0.0.0.0:1443

Unfortunately it isn't feasible to add it to the existing line with how nginx's logging is set up.