-
Notifications
You must be signed in to change notification settings - Fork 29
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
d36ad25
commit 8b53397
Showing
2 changed files
with
53 additions
and
19 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
8b53397
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hi,
I am trying to build against openssl tls1.3-draft-18 branch of openssl, and get this error.
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c: In function ‘ngx_ssl_ct_merge_srv_conf’:
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c:164:19: error: ‘SSL_EXT_CLIENT_HELLO’ undeclared (first use in this function)
int context = SSL_EXT_CLIENT_HELLO
^
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c:164:19: note: each undeclared identifier is reported only once for each function it appears in
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c:165:19: error: ‘SSL_EXT_TLS1_2_SERVER_HELLO’ undeclared (first use in this function)
| SSL_EXT_TLS1_2_SERVER_HELLO
^
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c:166:19: error: ‘SSL_EXT_TLS1_3_CERTIFICATE’ undeclared (first use in this function)
| SSL_EXT_TLS1_3_CERTIFICATE;
^
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c:167:5: error: implicit declaration of function ‘SSL_CTX_add_custom_ext’ [-Werror=implicit-function-declaration]
if (SSL_CTX_add_custom_ext(ssl_ctx, NGX_SSL_CT_EXT, context,
^
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c: In function ‘ngx_ssl_ct_ext_cb’:
/home/alex/workspace/nginx-ct/ngx_ssl_ct_module.c:192:20: error: ‘SSL_EXT_TLS1_3_CERTIFICATE’ undeclared (first use in this function)
if (context == SSL_EXT_TLS1_3_CERTIFICATE && chainidx != 0) {
^
cc1: all warnings being treated as errors
make[1]: *** [objs/addon/nginx-ct/ngx_ssl_ct_module.o] Error 1
make[1]: Leaving directory `/home/alex/workspace/nginx/nginx-1.13.0'
make: *** [build] Error 2
Which version of openssl does this commit support? Thanks.
8b53397
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
The master branch.
8b53397
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Same for me. It seems it won't work with the tls1.3-draft-18 branch.
8b53397
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, the tls1.3-draft-18 branch doesn't have the new custom extension functions, which I think means the custom extension won't work in TLS 1.3 connections anyway - so adding support seems pointless.
8b53397
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
FWIW, looks like the CT extension may need to be moved to the EncryptedExtensions message for TLS1.3, see:
https://www.openssl.org/blog/blog/2017/05/04/tlsv1.3/ (Custom Extensions and Certificate Transparency)
8b53397
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@plinss: this commit moves it to the Certificate message as per the table on page 39 of draft-ietf-tls-tls13-20.