Nginx如何升级Openssl

1. 什么是Openssl？

在计算机网络上，OpenSSL是一个开放源代码的软件库包，应用程序可以使用这个包来进行安全通信，避免窃听，同时确认另一端连线者的身份。这个包广泛被应用在互联网的网页服务器上。

其主要库是以C语言所写成，实现了基本的加密功能，实现了SSL与TLS协议。OpenSSL可以运行在OpenVMS、 Microsoft Windows以及绝大多数类Unix操作系统上（包括Solaris，Linux，Mac OS X与各种版本的开放源代码BSD操作系统）。

虽然此软件是开放源代码的，但其许可书条款与GPL有冲突之处，故GPL软件使用OpenSSL时（如Wget）必须对OpenSSL给予例外。

https://www.openssl.org/

2. 什么是心脏滴血？

心脏出血漏洞（英语：Heartbleed bug），简称为心血漏洞,是一个出现在加密程序库OpenSSL的安全漏洞，该程序库广泛用于实现互联网的传输层安全（TLS）协议。它于2012年被引入了OpenSSL中，2014年4月首次向公众披露。只要使用的是存在缺陷的OpenSSL实例，无论是服务器还是客户端，都可能因此而受到攻击。此问题的原因是在实现TLS的心跳扩展时没有对输入进行适当验证（缺少边界检查，因此漏洞的名称来源于“心跳”（heartbeat。该程序错误属于缓冲区过读,即可以读取的数据比应该允许读取的还多。

心脏出血在通用漏洞披露（CVE）系统中的编号为CVE-2014-0160。加拿大网络事故响应中心发布安全公告，提醒系统管理员注意漏洞。2014年4月7日，即漏洞公开披露的同一天，OpenSSL发布了修复后的版本。

截至2014年5月20日，在80万最热门的启用TLS的网站中，仍有1.5％易受心脏出血漏洞的攻击。

因为缺陷在于OpenSSL的实现，而不是SSL/TLS协议本身，所以除了OpenSSL之外的其他TLS实现方式，如GnuTLS、Mozilla的网络安全服务（NSS）和Windows平台的TLS实现都不受影响。

3. Nginx升级openssl

3.1 查看现openssl版本

# nginx -V
nginx version: nginx/1.22.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
built with OpenSSL 1.0.2k-fips  26 Jan 2017
TLS SNI support enabled

3.2 官方下载新的openssl安装包并解压

也可在GitHub上下载: https://github.com/openssl/openssl/releases

# wget https://www.openssl.org/source/openssl-3.0.8.tar.gz -P /opt/ --no-check-certificate
]# tar -xf openssl-3.0.8.tar.gz

3.3 重新编译Nginx

# ./configure  --prefix=/apps/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module --with-openssl=/opt/openssl-3.0.8

3.4 编译时报错

# make
make -f objs/Makefile
make[1]: 进入目录“/usr/local/src/nginx-1.22.1”
cd /opt/openssl-3.0.8 \
&& if [ -f Makefile ]; then make clean; fi \
&& ./config --prefix=/opt/openssl-3.0.8/.openssl no-shared no-threads  \
&& make \
&& make install_sw LIBDIR=lib
Can't locate IPC/Cmd.pm in @INC (@INC contains: /opt/openssl-3.0.8/util/perl /usr/local/lib64/perl5 /usr/local/share/perl5 /usr/lib64/perl5/vendor_perl /usr/share/perl5/vendor_perl /usr/lib64/perl5 /usr/share/perl5 . /opt/openssl-3.0.8/external/perl/Text-Template-1.56/lib) at /opt/openssl-3.0.8/util/perl/OpenSSL/config.pm line 19.
BEGIN failed--compilation aborted at /opt/openssl-3.0.8/util/perl/OpenSSL/config.pm line 19.
Compilation failed in require at /opt/openssl-3.0.8/Configure line 23.
BEGIN failed--compilation aborted at /opt/openssl-3.0.8/Configure line 23.
make[1]: *** [/opt/openssl-3.0.8/.openssl/include/openssl/ssl.h] 错误 2

3.5 解决方法

yum install -y perl-CPAN
[root@haitang-nginx-test openssl-3.0.8]# perl -MCPAN -e shell

CPAN.pm requires configuration, but most of it can be done automatically.
If you answer 'no' below, you will enter an interactive dialog for each
configuration option instead.

Would you like to configure as much as possible automatically? [yes] yes

 <install_help>

Warning: You do not have write permission for Perl library directories.

To install modules, you need to configure a local Perl library directory or
escalate your privileges.  CPAN can help you by bootstrapping the local::lib
module or by configuring itself to use 'sudo' (if available).  You may also
resolve this problem manually if you need to customize your setup.

What approach do you want?  (Choose 'local::lib', 'sudo' or 'manual')

3.6 安装缺省的包

cpan[1]> install IPC/Cmd.pm
..............................................................DONE
Fetching with HTTP::Tiny:
http://www.cpan.org/modules/03modlist.data.gz
Reading '/root/.cpan/sources/modules/03modlist.data.gz'
DONE
Writing /root/.cpan/Metadata
Running install for module 'IPC::Cmd'
Running make for B/BI/BINGOS/IPC-Cmd-1.04.tar.gz
Fetching with HTTP::Tiny:
http://www.cpan.org/authors/id/B/BI/BINGOS/IPC-Cmd-1.04.tar.gz
Fetching with HTTP::Tiny:
http://www.cpan.org/authors/id/B/BI/BINGOS/CHECKSUMS
Checksum for /root/.cpan/sources/authors/id/B/BI/BINGOS/IPC-Cmd-1.04.tar.gz ok
Scanning cache /root/.cpan/build for sizes
DONE

  CPAN.pm: Building B/BI/BINGOS/IPC-Cmd-1.04.tar.gz

Checking if your kit is complete...
Looks good
Warning: prerequisite Locale::Maketext::Simple 0 not found.
Warning: prerequisite Module::Load::Conditional 0.66 not found.
Warning: prerequisite Params::Check 0.20 not found.
Warning: prerequisite Test::More 0 not found.
Writing Makefile for IPC::Cmd
Could not read metadata file. Falling back to other methods to determine prerequisites
---- Unsatisfied dependencies detected during ----
----        BINGOS/IPC-Cmd-1.04.tar.gz        ----
    Test::More [requires]
    Locale::Maketext::Simple [requires]
    Module::Load::Conditional [requires]
    Params::Check [requires]

3.7 安装完成继续执行编译操作。

# ./configure  --prefix=/apps/nginx --user=nginx --group=nginx --with-http_ssl_module --with-http_v2_module --with-http_realip_module --with-http_stub_status_module --with-http_gzip_static_module --with-pcre --with-stream --with-stream_ssl_module --with-stream_realip_module --with-openssl=/opt/openssl-3.0.8
checking for OS
 + Linux 3.10.0-1062.el7.x86_64 x86_64
checking for C compiler ... found
 + using GNU C compiler
 + gcc version: 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
checking for gcc -pipe switch ... found
checking for -Wl,-E switch ... found
checking for gcc builtin atomic operations ... found
checking for C99 variadic macros ... found
checking for gcc variadic macros ... found
checking for gcc builtin 64 bit byteswap ... found

3.8 执行make && make install

# make && make install
cp objs/nginx '/apps/nginx/sbin/nginx'
test -d '/apps/nginx/conf' \
	|| mkdir -p '/apps/nginx/conf'
cp conf/koi-win '/apps/nginx/conf'
cp conf/koi-utf '/apps/nginx/conf'
cp conf/win-utf '/apps/nginx/conf'
test -f '/apps/nginx/conf/mime.types' \
	|| cp conf/mime.types '/apps/nginx/conf'
cp conf/mime.types '/apps/nginx/conf/mime.types.default'
test -f '/apps/nginx/conf/fastcgi_params' \
	|| cp conf/fastcgi_params '/apps/nginx/conf'
cp conf/fastcgi_params \
	'/apps/nginx/conf/fastcgi_params.default'
test -f '/apps/nginx/conf/fastcgi.conf' \
	|| cp conf/fastcgi.conf '/apps/nginx/conf'
cp conf/fastcgi.conf '/apps/nginx/conf/fastcgi.conf.default'
test -f '/apps/nginx/conf/uwsgi_params' \
	|| cp conf/uwsgi_params '/apps/nginx/conf'
cp conf/uwsgi_params \
	'/apps/nginx/conf/uwsgi_params.default'
test -f '/apps/nginx/conf/scgi_params' \
	|| cp conf/scgi_params '/apps/nginx/conf'
cp conf/scgi_params \
	'/apps/nginx/conf/scgi_params.default'
test -f '/apps/nginx/conf/nginx.conf' \
	|| cp conf/nginx.conf '/apps/nginx/conf/nginx.conf'
cp conf/nginx.conf '/apps/nginx/conf/nginx.conf.default'
test -d '/apps/nginx/logs' \
	|| mkdir -p '/apps/nginx/logs'
test -d '/apps/nginx/logs' \
	|| mkdir -p '/apps/nginx/logs'
test -d '/apps/nginx/html' \
	|| cp -R html '/apps/nginx'
test -d '/apps/nginx/logs' \
	|| mkdir -p '/apps/nginx/logs'
make[1]: 离开目录“/usr/local/src/nginx-1.22.1”

3.9 查看是否升级成功

# nginx -V
nginx version: nginx/1.22.1
built by gcc 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC)
built with OpenSSL 3.0.8 7 Feb 2023
TLS SNI support enabled