openresty / openresty/encrypted-session-nginx-module
Outdated module in new Linux distros
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 203
- Forks
- 50
- Avg merge
- 1h 25m
- Merged PRs (30d)
- 2
Description
This module is totally outdated in any Linux distro that had removed OpenSSL 1 support (for example Debian 12). It is not recommended to use OpenSSL anymore as it is not secure anymore since previous year
When you try to compile the module it will show this error and it cannot be compiled:
encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c:90:5: error: ‘MD5’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
90 | MD5(data, data_size, p);
| ^~~
In file included from encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c:15:
/usr/include/openssl/md5.h:52:38: note: declared here
52 | OSSL_DEPRECATEDIN_3_0 unsigned char *MD5(const unsigned char *d, size_t n,
| ^~~
encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c: In function ‘ngx_http_encrypted_session_aes_mac_decrypt’:
encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c:228:5: error: ‘MD5’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
228 | MD5(*dst, *dst_len, new_digest);
| ^~~
/usr/include/openssl/md5.h:52:38: note: declared here
52 | OSSL_DEPRECATEDIN_3_0 unsigned char *MD5(const unsigned char *d, size_t n,
| ^~~
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c, especially the MD5 calls reported at lines 90 and 228. Reproduce the module compilation on Debian 12 or another Linux distribution using OpenSSL 3, then trace the affected encryption and decryption paths. Done means the module compiles without the reported deprecated-declarations errors and the existing behavior remains covered.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100