Skip to content

Commit c9a511f

Browse files
prince-chrismcbotovq
prince-chrismc
and
botovq
authored
🔒 Update SSL libraries to latest versions (#235)
* Bump test SSL libraries * Fix copy paste error * fix bad spacing * Update README.md * bump again * remove libressl 3.5.3 * Update ssl.yml * put back 3.5.x for failing badge * Update action.yml * point URLs back to main since testing worked * Only publish badge on push leftover from me testing on my fork 25 days ago 😭 * Trying using 1.1 apis with libressl libressl/portable#764 (comment) Co-Authored-By: Theo Buehler <botovq@users.noreply.github.com> * Limit new APIs to required version limit change to older supported versions * Update tests for new libressl APIs Co-authored-by: Theo Buehler <botovq@users.noreply.github.com>
1 parent 9f36be9 commit c9a511f

File tree

5 files changed

+64
-35
lines changed

5 files changed

+64
-35
lines changed

‎.github/actions/badge/action.yml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ inputs:
55
description: The subfolder where to group the badges
66
required: true
77
label:
8-
description: The label to you in the badge (this should be unqie for each badge in a category)
8+
description: The label to you in the badge (this should be unique for each badge in a category)
99
required: true
1010
github_token:
1111
description: The token to use to publish the changes
@@ -14,13 +14,12 @@ inputs:
1414
runs:
1515
using: composite
1616
steps:
17-
- if: success()
17+
- if: job.status == 'success'
1818
uses: ./.github/actions/badge/write
1919
with:
2020
category: ${{ inputs.category }}
2121
label: ${{ inputs.label }}
22-
- if: |
23-
!success()
22+
- if: job.status == 'failure'
2423
uses: ./.github/actions/badge/write
2524
with:
2625
category: ${{ inputs.category }}

‎.github/workflows/ssl.yml

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,8 @@ jobs:
1212
strategy:
1313
matrix:
1414
openssl:
15-
- { tag: "openssl-3.0.1", name: "3.0.1" }
16-
- { tag: "OpenSSL_1_1_1m", name: "1.1.1m" }
15+
- { tag: "openssl-3.0.3", name: "3.0.3" }
16+
- { tag: "OpenSSL_1_1_1o", name: "1.1.1o" }
1717
- { tag: "OpenSSL_1_1_0i", name: "1.1.0i" } # Do not bump, there's a broken in the autoconfig script and it's not maintained
1818
- { tag: "OpenSSL_1_0_2u", name: "1.0.2u" }
1919
- { tag: "OpenSSL_1_0_1u", name: "1.0.1u" }
@@ -47,7 +47,7 @@ jobs:
4747
- uses: ./.github/actions/install/gtest
4848
- uses: ./.github/actions/install/openssl
4949
with:
50-
version: "openssl-3.0.1"
50+
version: "openssl-3.0.3"
5151

5252
- name: configure
5353
run: cmake . -DJWT_BUILD_TESTS=ON -DOPENSSL_ROOT_DIR=/tmp -DCMAKE_CXX_FLAGS="-DOPENSSL_NO_DEPRECATED=1" -DCMAKE_C_FLAGS="-DOPENSSL_NO_DEPRECATED=1"
@@ -56,8 +56,9 @@ jobs:
5656
libressl:
5757
runs-on: ubuntu-latest
5858
strategy:
59+
fail-fast: false
5960
matrix:
60-
libressl: ["3.4.2", "3.3.5", "3.2.7"]
61+
libressl: ["3.5.3", "3.4.3", "3.3.6"]
6162
name: LibreSSL ${{ matrix.libressl }}
6263
steps:
6364
- uses: actions/checkout@v2
@@ -84,8 +85,9 @@ jobs:
8485
strategy:
8586
matrix:
8687
wolfssl:
87-
- { ref: "v5.0.0-stable", name: "5.0.0" }
8888
- { ref: "v5.1.1-stable", name: "5.1.1"}
89+
- { ref: "v5.2.0-stable", name: "5.2.0" }
90+
- { ref: "v5.3.0-stable", name: "5.3.0"}
8991
name: wolfSSL ${{ matrix.wolfssl.name }}
9092
steps:
9193
- uses: actions/checkout@v2

‎README.md

Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -40,22 +40,23 @@ In the name of flexibility and extensibility, jwt-cpp supports [OpenSSL](https:/
4040

4141
| OpenSSL | LibreSSL | wolfSSL |
4242
|-------------------|----------------|----------------|
43-
| ![1.0.2u][o1.0.2] | ![3.2.7][l3.2] | ![5.0.0][w5.0] |
44-
| ![1.1.0i][o1.1.0] | ![3.3.5][l3.3] | ![5.1.1][w5.1] |
45-
| ![1.1.1m][o1.1.1] | ![3.4.2][l3.4] | |
46-
| ![3.0.1][o3.0] | | |
43+
| ![1.0.2u][o1.0.2] | ![3.3.6][l3.3] | ![5.1.1][w5.1] |
44+
| ![1.1.0i][o1.1.0] | ![3.4.3][l3.4] | ![5.2.0][w5.2] |
45+
| ![1.1.1o][o1.1.1] | ![3.5.3][l3.5] | ![5.3.0][w5.3] |
46+
| ![3.0.3][o3.0] | | |
4747

4848
> ℹ️ Note: A complete list of versions tested in the past can be found [here](https://github.com/Thalhammer/jwt-cpp/tree/badges).
4949
5050
[o1.0.2]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/openssl/1.0.2u/shields.json
5151
[o1.1.0]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/openssl/1.1.0i/shields.json
52-
[o1.1.1]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/openssl/1.1.1m/shields.json
53-
[o3.0]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/openssl/3.0.1/shields.json
54-
[l3.2]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/libressl/3.2.7/shields.json
55-
[l3.3]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/libressl/3.3.5/shields.json
56-
[l3.4]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/libressl/3.4.2/shields.json
57-
[w5.0]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/wolfssl/5.0.0/shields.json
52+
[o1.1.1]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/openssl/1.1.1o/shields.json
53+
[o3.0]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/openssl/3.0.3/shields.json
54+
[l3.3]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/libressl/3.3.6/shields.json
55+
[l3.4]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/libressl/3.4.3/shields.json
56+
[l3.5]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/libressl/3.5.3/shields.json
5857
[w5.1]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/wolfssl/5.1.1/shields.json
58+
[w5.2]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/wolfssl/5.2.0/shields.json
59+
[w5.3]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/wolfssl/5.3.0/shields.json
5960

6061
## Overview
6162

@@ -79,7 +80,7 @@ For your convience there are serval traits implementation which provide some pop
7980
[jsoncons]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/traits/danielaparker-jsoncons/shields.json
8081
[boostjson]: https://img.shields.io/endpoint?url=https://raw.githubusercontent.com/Thalhammer/jwt-cpp/badges/traits/boost-json/shields.json
8182
82-
In order to maintain compatibility, [picojson](https://github.com/kazuho/picojson) is still used to provide a specialized `jwt::claim` along with all helpers. Defining `JWT_DISABLE_PICOJSON` will remove this optional dependency. It's possible to directly include the traits defaults for the other JSON libraries. See the [traits examples](https://github.com/prince-chrismc/jwt-cpp/tree/master/example/traits) for details.
83+
In order to maintain compatibility, [picojson](https://github.com/kazuho/picojson) is still used to provide a specialized `jwt::claim` along with all helpers. Defining `JWT_DISABLE_PICOJSON` will remove this optional dependency. It's possible to directly include the traits defaults for the other JSON libraries. See the [traits examples](https://github.com/Thalhammer/jwt-cpp/tree/master/example/traits) for details.
8384
8485
As for the base64 requirements of JWTs, this libary provides `base.h` with all the required implentation; However base64 implementations are very common, with varying degrees of performance. When providing your own base64 implementation, you can define `JWT_DISABLE_BASE64` to remove the jwt-cpp implementation.
8586

‎include/jwt-cpp/jwt.h

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -54,8 +54,12 @@
5454
#endif
5555

5656
#if defined(LIBRESSL_VERSION_NUMBER)
57+
#if LIBRESSL_VERSION_NUMBER >= 0x3050300fL
58+
#define JWT_OPENSSL_1_1_0
59+
#else
5760
#define JWT_OPENSSL_1_0_0
5861
#endif
62+
#endif
5963

6064
#if defined(LIBWOLFSSL_VERSION_HEX)
6165
#define JWT_OPENSSL_1_1_1

‎tests/OpenSSLErrorTest.cpp

Lines changed: 38 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -566,9 +566,17 @@ TEST(OpenSSLErrorTest, LoadPublicKeyCertFromStringReference) {
566566
}
567567

568568
TEST(OpenSSLErrorTest, LoadPublicKeyCertFromString) {
569-
std::vector<multitest_entry> mapping{{&fail_BIO_new, 1, jwt::error::rsa_error::create_mem_bio_failed},
570-
{&fail_BIO_write, 1, jwt::error::rsa_error::load_key_bio_write},
571-
{&fail_PEM_read_bio_PUBKEY, 1, jwt::error::rsa_error::load_key_bio_read}};
569+
std::vector<multitest_entry> mapping {
570+
{&fail_BIO_new, 1, jwt::error::rsa_error::create_mem_bio_failed},
571+
#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x3050300fL
572+
{&fail_BIO_write, 1, jwt::error::rsa_error::load_key_bio_write},
573+
#else
574+
{&fail_BIO_write, 1, jwt::error::rsa_error::write_key_failed},
575+
#endif
576+
{
577+
&fail_PEM_read_bio_PUBKEY, 1, jwt::error::rsa_error::load_key_bio_read
578+
}
579+
};
572580

573581
run_multitest(mapping, [](std::error_code& ec) {
574582
try {
@@ -579,9 +587,17 @@ TEST(OpenSSLErrorTest, LoadPublicKeyCertFromString) {
579587
}
580588

581589
TEST(OpenSSLErrorTest, LoadPublicKeyCertFromStringErrorCode) {
582-
std::vector<multitest_entry> mapping{{&fail_BIO_new, 1, jwt::error::rsa_error::create_mem_bio_failed},
583-
{&fail_BIO_write, 1, jwt::error::rsa_error::load_key_bio_write},
584-
{&fail_PEM_read_bio_PUBKEY, 1, jwt::error::rsa_error::load_key_bio_read}};
590+
std::vector<multitest_entry> mapping {
591+
{&fail_BIO_new, 1, jwt::error::rsa_error::create_mem_bio_failed},
592+
#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x3050300fL
593+
{&fail_BIO_write, 1, jwt::error::rsa_error::load_key_bio_write},
594+
#else
595+
{&fail_BIO_write, 1, jwt::error::rsa_error::write_key_failed},
596+
#endif
597+
{
598+
&fail_PEM_read_bio_PUBKEY, 1, jwt::error::rsa_error::load_key_bio_read
599+
}
600+
};
585601

586602
run_multitest(mapping, [](std::error_code& ec) {
587603
auto res = jwt::helper::load_public_key_from_string(sample_cert, "", ec);
@@ -720,15 +736,22 @@ TEST(OpenSSLErrorTest, LoadECDSAPublicKeyFromString) {
720736
}
721737

722738
TEST(OpenSSLErrorTest, ECDSACertificate) {
723-
std::vector<multitest_entry> mapping{{&fail_BIO_new, 1, jwt::error::ecdsa_error::create_mem_bio_failed},
724-
{&fail_BIO_write, 1, jwt::error::ecdsa_error::load_key_bio_write},
725-
{&fail_PEM_read_bio_PUBKEY, 1, jwt::error::ecdsa_error::load_key_bio_read},
726-
// extract_pubkey_from_cert
727-
{&fail_BIO_new, 2, jwt::error::rsa_error::create_mem_bio_failed},
728-
{&fail_PEM_read_bio_X509, 1, jwt::error::rsa_error::cert_load_failed},
729-
{&fail_X509_get_pubkey, 1, jwt::error::rsa_error::get_key_failed},
730-
{&fail_PEM_write_bio_PUBKEY, 1, jwt::error::rsa_error::write_key_failed},
731-
{&fail_BIO_ctrl, 1, jwt::error::rsa_error::convert_to_pem_failed}};
739+
std::vector<multitest_entry> mapping {
740+
{&fail_BIO_new, 1, jwt::error::ecdsa_error::create_mem_bio_failed},
741+
#if !defined(LIBRESSL_VERSION_NUMBER) || LIBRESSL_VERSION_NUMBER < 0x3050300fL
742+
{&fail_BIO_write, 1, jwt::error::ecdsa_error::load_key_bio_write},
743+
#else
744+
{&fail_BIO_write, 1, jwt::error::rsa_error::write_key_failed},
745+
#endif
746+
{&fail_PEM_read_bio_PUBKEY, 1, jwt::error::ecdsa_error::load_key_bio_read},
747+
// extract_pubkey_from_cert
748+
{&fail_BIO_new, 2, jwt::error::rsa_error::create_mem_bio_failed},
749+
{&fail_PEM_read_bio_X509, 1, jwt::error::rsa_error::cert_load_failed},
750+
{&fail_X509_get_pubkey, 1, jwt::error::rsa_error::get_key_failed},
751+
{&fail_PEM_write_bio_PUBKEY, 1, jwt::error::rsa_error::write_key_failed}, {
752+
&fail_BIO_ctrl, 1, jwt::error::rsa_error::convert_to_pem_failed
753+
}
754+
};
732755

733756
run_multitest(mapping, [](std::error_code& ec) {
734757
try {

0 commit comments

Comments
 (0)