openresty / openresty/encrypted-session-nginx-module

Outdated module in new Linux distros

Open
#35 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
203
Forks
50
Avg merge
1h 25m
Merged PRs (30d)
2

Description

This module is totally outdated in any Linux distro that had removed OpenSSL 1 support (for example Debian 12). It is not recommended to use OpenSSL anymore as it is not secure anymore since previous year

When you try to compile the module it will show this error and it cannot be compiled:

encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c:90:5: error: ‘MD5’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
   90 |     MD5(data, data_size, p);
      |     ^~~
In file included from encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c:15:
/usr/include/openssl/md5.h:52:38: note: declared here
   52 | OSSL_DEPRECATEDIN_3_0 unsigned char *MD5(const unsigned char *d, size_t n,
      |                                      ^~~
encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c: In function ‘ngx_http_encrypted_session_aes_mac_decrypt’:
encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c:228:5: error: ‘MD5’ is deprecated: Since OpenSSL 3.0 [-Werror=deprecated-declarations]
  228 |     MD5(*dst, *dst_len, new_digest);
      |     ^~~
/usr/include/openssl/md5.h:52:38: note: declared here
   52 | OSSL_DEPRECATEDIN_3_0 unsigned char *MD5(const unsigned char *d, size_t n,
      |                                      ^~~

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with encrypted-session-nginx-module/src/ngx_http_encrypted_session_cipher.c, especially the MD5 calls reported at lines 90 and 228. Reproduce the module compilation on Debian 12 or another Linux distribution using OpenSSL 3, then trace the affected encryption and decryption paths. Done means the module compiles without the reported deprecated-declarations errors and the existing behavior remains covered.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.