From a7ecd29462f0362a167cf268274f8941541257dd Mon Sep 17 00:00:00 2001 From: Masakazu Kitajo Date: Fri, 5 Apr 2024 17:44:51 -0600 Subject: [PATCH 1/5] Make code buildable with AWS-LC --- CMakeLists.txt | 31 +++++++++++++++++++++---------- plugins/CMakeLists.txt | 2 +- src/iocore/net/OCSPStapling.cc | 4 ++-- src/iocore/net/P_OCSPStapling.h | 2 +- src/iocore/net/SSLUtils.cc | 6 +++--- 5 files changed, 28 insertions(+), 17 deletions(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 52e20ee2bdb..4308bc39da2 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -259,27 +259,34 @@ pkg_check_modules(PCRE2 REQUIRED IMPORTED_TARGET libpcre2-8) include(CheckOpenSSLIsBoringSSL) include(CheckOpenSSLIsQuictls) +include(CheckOpenSSLIsAwsLc) find_package(OpenSSL REQUIRED) -check_openssl_is_boringssl(OPENSSL_IS_BORINGSSL BORINGSSL_VERSION "${OPENSSL_INCLUDE_DIR}") +check_openssl_is_boringssl(SSLLIB_IS_BORINGSSL BORINGSSL_VERSION "${OPENSSL_INCLUDE_DIR}") +check_openssl_is_awslc(SSLLIB_IS_AWSLC AWSLC_VERSION "${OPENSSL_INCLUDE_DIR}") -if(OPENSSL_IS_BORINGSSL) +if(SSLLIB_IS_BORINGSSL) # The consensus is a commit newer than a1843d660b47116207877614af53defa767be46a # The commit that changes API_VERSION to 27 is actually a little bit older than the commit but still a reasonable commit set(min_bssl "27") if(BORINGSSL_VERSION VERSION_LESS "${min_bssl}") - message(FATAL_ERROR "BoringSSL API version >= ${min_bssl} or OpenSSL required") + message(FATAL_ERROR "BoringSSL API version >= ${min_bssl} or another SSL library required") + endif() +elseif(SSLLIB_IS_AWSLC) + set(min_assl "27") + if(AWSLC_VERSION VERSION_LESS "${min_assl}") + message(FATAL_ERROR "AWS-LC API version >= ${min_assl} or anonther SSL library required") endif() else() set(min_ossl "1.1.1") if(OPENSSL_VERSION VERSION_LESS "${min_ossl}") - message(FATAL_ERROR "OpenSSL version >= ${min_ossl} or BoringSSL required") + message(FATAL_ERROR "OpenSSL version >= ${min_ossl} or another SSL library required") endif() endif() -check_openssl_is_quictls(OPENSSL_IS_QUICTLS "${OPENSSL_INCLUDE_DIR}") +check_openssl_is_quictls(SSLLIB_IS_QUICTLS "${OPENSSL_INCLUDE_DIR}") if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0") - set(OPENSSL_IS_OPENSSL3 TRUE) - add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_OPENSSL3) + set(SSLLIB_IS_OPENSSL3 TRUE) + add_compile_definitions(OPENSSL_API_COMPAT=10002 SSLLIB_IS_OPENSSL3) endif() if(ENABLE_PROFILER) @@ -302,11 +309,11 @@ if(ENABLE_QUICHE) set(TS_HAS_QUICHE ${quiche_FOUND}) set(TS_USE_QUIC ${TS_HAS_QUICHE}) - if(NOT OPENSSL_IS_BORINGSSL AND NOT OPENSSL_IS_QUICTLS) + if(NOT SSLLIB_IS_BORINGSSL AND NOT SSLLIB_IS_QUICTLS) message(FATAL_ERROR "Use of BoringSSL or OPENSSL/QUICTLS is required if quiche is used.") endif() - if(OPENSSL_IS_QUICTLS) + if(SSLLIB_IS_QUICTLS) # Until we get quictls support integrated with quiche, we just print this message. # Once the above that is done, then we can just validate the version. message( @@ -443,6 +450,7 @@ check_symbol_exists(DH_get_2048_256 "openssl/dh.h" TS_USE_GET_DH_2048_256) check_symbol_exists(OPENSSL_NO_TLS_3 "openssl/ssl.h" TS_NO_USE_TLS12) check_symbol_exists(SSL_CTX_set_client_hello_cb "openssl/ssl.h" TS_USE_HELLO_CB) check_symbol_exists(SSL_set1_verify_cert_store "openssl/ssl.h" TS_HAS_VERIFY_CERT_STORE) +check_symbol_exists(SSL_get_shared_curve "openssl/ssl.h" HAVE_SSL_GET_SHARED_CURVE) check_symbol_exists(SSL_set_max_early_data "openssl/ssl.h" HAVE_SSL_SET_MAX_EARLY_DATA) check_symbol_exists(SSL_read_early_data "openssl/ssl.h" HAVE_SSL_READ_EARLY_DATA) check_symbol_exists(SSL_write_early_data "openssl/ssl.h" HAVE_SSL_WRITE_EARLY_DATA) @@ -453,9 +461,12 @@ check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_cb "openssl/ssl.h" HAVE_SSL_CT check_symbol_exists(SSL_get_all_async_fds openssl/ssl.h TS_USE_TLS_ASYNC) check_symbol_exists(TLS1_3_VERSION "openssl/ssl.h" TS_USE_TLS13) check_symbol_exists(MD5_Init "openssl/md5.h" HAVE_MD5_INIT) +check_symbol_exists(ENGINE_load_dynamic "include/openssl/engine.h" HAVE_ENGINE_LOAD_DYNAMIC) +check_symbol_exists(ENGINE_get_default_RSA "include/openssl/engine.h" HAVE_ENGINE_GET_DEFAULT_RSA) +check_symbol_exists(ENGINE_load_private_key "include/openssl/engine.h" HAVE_ENGINE_LOAD_PRIVATE_KEY) check_symbol_exists(sysctlbyname "sys/sysctl.h" HAVE_SYSCTLBYNAME) -if(OPENSSL_IS_OPENSSL3) +if(SSLLIB_IS_OPENSSL3) check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_evp_cb "openssl/ssl.h" TS_HAS_TLS_SESSION_TICKET) else() check_symbol_exists(SSL_CTX_set_tlsext_ticket_key_cb "openssl/ssl.h" TS_HAS_TLS_SESSION_TICKET) diff --git a/plugins/CMakeLists.txt b/plugins/CMakeLists.txt index 4d0e24419b4..ba655b15b2f 100644 --- a/plugins/CMakeLists.txt +++ b/plugins/CMakeLists.txt @@ -45,7 +45,7 @@ add_subdirectory(tcpinfo) add_subdirectory(traffic_dump) add_subdirectory(xdebug) -if(NOT OPENSSL_IS_BORINGSSL) +if(NOT SSLLIB_IS_BORINGSSL AND NOT SSLLIB_IS_AWSLC) add_subdirectory(ja3_fingerprint) endif() diff --git a/src/iocore/net/OCSPStapling.cc b/src/iocore/net/OCSPStapling.cc index 238d9a244a4..daf26bc166a 100644 --- a/src/iocore/net/OCSPStapling.cc +++ b/src/iocore/net/OCSPStapling.cc @@ -1303,7 +1303,7 @@ ocsp_update() // RFC 6066 Section-8: Certificate Status Request int -#ifndef OPENSSL_IS_BORINGSSL +#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) ssl_callback_ocsp_stapling(SSL *ssl) #else ssl_callback_ocsp_stapling(SSL *ssl, void *) @@ -1331,7 +1331,7 @@ ssl_callback_ocsp_stapling(SSL *ssl, void *) } certinfo *cinf = nullptr; -#ifndef OPENSSL_IS_BORINGSSL +#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) certinfo_map::iterator iter = map->find(cert); if (iter != map->end()) { cinf = iter->second; diff --git a/src/iocore/net/P_OCSPStapling.h b/src/iocore/net/P_OCSPStapling.h index fd88b860b2b..8caf132c97b 100644 --- a/src/iocore/net/P_OCSPStapling.h +++ b/src/iocore/net/P_OCSPStapling.h @@ -29,7 +29,7 @@ void ssl_stapling_ex_init(); bool ssl_stapling_init_cert(SSL_CTX *ctx, X509 *cert, const char *certname, const char *rsp_file); void ocsp_update(); -#ifndef OPENSSL_IS_BORINGSSL +#if !defined(OPENSSL_IS_BORINGSSL) && !defined(OPENSSL_IS_AWSLC) int ssl_callback_ocsp_stapling(SSL *); #else int ssl_callback_ocsp_stapling(SSL *, void *); diff --git a/src/iocore/net/SSLUtils.cc b/src/iocore/net/SSLUtils.cc index 4007741f4d9..3a46e78a52f 100644 --- a/src/iocore/net/SSLUtils.cc +++ b/src/iocore/net/SSLUtils.cc @@ -876,7 +876,7 @@ void SSLPostConfigInitialize() { if (SSLConfigParams::engine_conf_file) { -#ifndef OPENSSL_IS_BORINGSSL +#if HAVE_ENGINE_LOAD_DYNAMIC ENGINE_load_dynamic(); #endif @@ -958,7 +958,7 @@ static bool SSLPrivateKeyHandler(SSL_CTX *ctx, const SSLConfigParams *params, const char *keyPath, const char *secret_data, int secret_data_len) { EVP_PKEY *pkey = nullptr; -#ifndef OPENSSL_IS_BORINGSSL +#if HAVE_ENGINE_GET_DEFAULT_RSA && HAVE_ENGINE_LOAD_PRIVATE_KEY ENGINE *e = ENGINE_get_default_RSA(); if (e != nullptr) { pkey = ENGINE_load_private_key(e, keyPath, nullptr, nullptr); @@ -2563,7 +2563,7 @@ SSLMultiCertConfigLoader::clear_pw_references(SSL_CTX *ssl_ctx) ssl_curve_id SSLGetCurveNID(SSL *ssl) { -#ifndef OPENSSL_IS_BORINGSSL +#if HAVE_SSL_GET_SHARED_CURVE return SSL_get_shared_curve(ssl, 0); #else return SSL_get_curve_id(ssl); From 590f620597cac8ec01f4c98e19a2d2b6742946d0 Mon Sep 17 00:00:00 2001 From: Masakazu Kitajo Date: Thu, 18 Apr 2024 12:55:20 -0600 Subject: [PATCH 2/5] Add CheckOpenSSLIsAwsLc.cmake --- cmake/CheckOpenSSLIsAwsLc.cmake | 43 +++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 cmake/CheckOpenSSLIsAwsLc.cmake diff --git a/cmake/CheckOpenSSLIsAwsLc.cmake b/cmake/CheckOpenSSLIsAwsLc.cmake new file mode 100644 index 00000000000..66969ee9017 --- /dev/null +++ b/cmake/CheckOpenSSLIsAwsLc.cmake @@ -0,0 +1,43 @@ +####################### +# +# Licensed to the Apache Software Foundation (ASF) under one or more contributor license +# agreements. See the NOTICE file distributed with this work for additional information regarding +# copyright ownership. The ASF licenses this file to you under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with the License. You may obtain +# a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software distributed under the License +# is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express +# or implied. See the License for the specific language governing permissions and limitations under +# the License. +# +####################### + +function(CHECK_OPENSSL_IS_AWSLC OUT_IS_AWSLC OUT_VERSION OPENSSL_INCLUDE_DIR) + set(CHECK_PROGRAM + " + #include + + #ifndef OPENSSL_IS_AWSLC + #error check failed + #endif + + int main() { + return 0; + } + " + ) + set(CMAKE_REQUIRED_INCLUDES "${OPENSSL_INCLUDE_DIR}") + include(CheckCXXSourceCompiles) + check_cxx_source_compiles("${CHECK_PROGRAM}" ${OUT_IS_AWSLC}) + if(${${OUT_IS_AWSLC}}) + file(STRINGS "${OPENSSL_INCLUDE_DIR}/openssl/base.h" version_line REGEX "^#define AWSLC_API_VERSION [0-9]+") + string(REGEX MATCH "[0-9]+" version ${version_line}) + set(${OUT_VERSION} + ${version} + PARENT_SCOPE + ) + endif() +endfunction() From 6f51991e6a46019bbaf4f3553f6c3b20424638de Mon Sep 17 00:00:00 2001 From: Masakazu Kitajo Date: Thu, 18 Apr 2024 13:57:16 -0600 Subject: [PATCH 3/5] Add cmakedefine for HAVE_SSL_GET_SHARED_CURVE --- include/tscore/ink_config.h.cmake.in | 1 + 1 file changed, 1 insertion(+) diff --git a/include/tscore/ink_config.h.cmake.in b/include/tscore/ink_config.h.cmake.in index 5e33ca19def..f36356d2d8d 100644 --- a/include/tscore/ink_config.h.cmake.in +++ b/include/tscore/ink_config.h.cmake.in @@ -161,6 +161,7 @@ const int DEFAULT_STACKSIZE = @DEFAULT_STACK_SIZE@; // TODO(cmcfarlen): Verify use of below in iocore/net/SSLNetVConnection (redunant) #cmakedefine01 HAVE_SSL_READ_EARLY_DATA #cmakedefine HAVE_SSL_SET_MAX_EARLY_DATA +#cmakedefine01 HAVE_SSL_GET_SHARED_CURVE #cmakedefine01 TS_USE_TLS_SET_CIPHERSUITES #define TS_BUILD_CANONICAL_HOST "@CMAKE_HOST@" From 2f05ba9cd6527dc58b909356627c7bd9e66e14f2 Mon Sep 17 00:00:00 2001 From: Masakazu Kitajo Date: Thu, 18 Apr 2024 14:43:40 -0600 Subject: [PATCH 4/5] Revert an unnecessary name change --- CMakeLists.txt | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CMakeLists.txt b/CMakeLists.txt index 4308bc39da2..1ae2de9bf64 100644 --- a/CMakeLists.txt +++ b/CMakeLists.txt @@ -286,7 +286,7 @@ check_openssl_is_quictls(SSLLIB_IS_QUICTLS "${OPENSSL_INCLUDE_DIR}") if(OPENSSL_VERSION VERSION_GREATER_EQUAL "3.0.0") set(SSLLIB_IS_OPENSSL3 TRUE) - add_compile_definitions(OPENSSL_API_COMPAT=10002 SSLLIB_IS_OPENSSL3) + add_compile_definitions(OPENSSL_API_COMPAT=10002 OPENSSL_IS_OPENSSL3) endif() if(ENABLE_PROFILER) From 5d83959014b8612e7720c9d6b7353c60bbcc151b Mon Sep 17 00:00:00 2001 From: Masakazu Kitajo Date: Thu, 18 Apr 2024 14:59:35 -0600 Subject: [PATCH 5/5] Fix a build condition for HKDF --- src/tscore/CMakeLists.txt | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/tscore/CMakeLists.txt b/src/tscore/CMakeLists.txt index a7a2e417b1d..b88d8945a0b 100644 --- a/src/tscore/CMakeLists.txt +++ b/src/tscore/CMakeLists.txt @@ -101,9 +101,9 @@ add_library(ts::tscore ALIAS tscore) # position independent. set_target_properties(tscore PROPERTIES POSITION_INDEPENDENT_CODE TRUE) -if(OPENSSL_IS_BORINGSSL) +if(SSLLIB_IS_BORINGSSL OR SSLLIB_IS_AWSLC) target_sources(tscore PRIVATE HKDF_boringssl.cc) -elseif(OPENSSL_IS_OPENSSL3) +elseif(SSLLIB_IS_OPENSSL3) target_sources(tscore PRIVATE HKDF_openssl3.cc) else() target_sources(tscore PRIVATE HKDF_openssl.cc)