Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add OpenSSL support to main branch #256

Draft
wants to merge 65 commits into
base: main
Choose a base branch
from
Draft

Add OpenSSL support to main branch #256

wants to merge 65 commits into from

Conversation

tedjpoole
Copy link
Contributor

This pull request just cherry-picks our OpenSSL related commits from the release/v1.31 branch into the main branch.

@tedjpoole tedjpoole force-pushed the add-openssl branch 2 times, most recently from a266cda to 9ffd7aa Compare September 30, 2024 13:18
tedjpoole and others added 26 commits October 18, 2024 11:27
@tedjpoole
Added bssl-compat sub directory
226bd23 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Added patches for jwt_verify_lib
c3a4ad8 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Added envoy-openssl specific bazelrc
c0012fe 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Code changes to compile on bssl-compat/openssl
2697ace 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Added basic build instructions and scripts
8a750bd 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Replaced BoringSSL submodule with a copy (ca1690e221677cea3fb946f324e…
38ba38a 
…b89d846ec53f2)

BoringSSL Commit ca1690e221677cea3fb946f324eb89d846ec53f2
Now in the bssl-compat/third_party/boringssl/ directory
According to https://boringssl.googlesource.com/boringssl/+/HEAD/INCORPORATING.md

Disabled the configure/build for BoringSSL because (1) it can't be done on all
platforms, and (2) we no longer need to configure/build BoringSSL to obtain it's
crypto_test_data.cc file because it is now checked in.

Removed the pre installation of go into the builder image. This was only being done
as a work around to support the BoringSSL configure/build, but that requirement has
now gone.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Updated README.md
c488d3c 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Add missing functions and types in Bssl compat. layer
4ec1092 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Dummy implementation of SSL_was_key_usage_invalid and SSL_set_enforce…
b7711ae 
…_rsa_key_usage

Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
OSSM-6274 Fixed some QUIC related compilation failures
e2adf00 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@jwendell @tedjpoole
Fix a compile error due to a missing include (#2)
543813f 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Realigned io_handle_bio_test.cc with upstream
f28a279 
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
SSL_CTX_get_session_cache_mode added to bssl layer
76c1807 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@jwendell @tedjpoole
[bp/1.28] Fix build error with maxmind if http3 is disabled (#33638)
c9941dd 
`maxmind` is causing the build to not honor the flag `--//bazel:http3=False`: The
define `ENVOY_ENABLE_QUIC` is still being passed to the compiler. This
causes code that rely on the presence (or not) of that define to behave
wrongly.

I am not 100% sure of what causes it, but Bazel doc says 1) to not use
`bind` and 2) that `bind` and `select` do not play well together: https://bazel.build/reference/be/workspace#bind

By removing the `bind` and pointing directly to the actual dependency in
`maxmind` BUILD file, we fix this issue.

Backport of envoyproxy/envoy#33638

Signed-off-by: Jonh Wendell <jwendell@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dgn @tedjpoole
Use OpenSSL's BIO_meth* functions instead of our wrappers
8b38b4d 
We can now use the original OpenSSL functions as Envoy has stopped
accessing the internal struct fields of BIO_METHOD (relevant change in
Envoy was in 0ff3fcb). This change also
removes our wrapper functions to deal with this behavior and the tests
for them.

Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dgn @tedjpoole
Add some missing symbols
00233d8 
Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Initial implementation of SSL_CTX_set_custom_verify()
5e85de4 
* Only supports synchronous (pass or fail) verification, which is enough to
accommodate the default certificate validator.

* Also fixed/extended the implementation of SSL_get_peer_full_cert_chain()
so that (1) it's return value now has the correct ownership semantics, and
(2) it works in the context of a SSL_CTX_set_custom_verify() callback.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Disabled compilation of QUIC code (by (mis)using the existing [no]fip…
088866d 
…s options)

Note that this really is a misuse of the "boringssl=fips" define, and the "nofips" tag.
However, pretending that we are building on a FIPS version of BoringSSL has the side
effect of compiling out QUIC support, which is what we want to achieve.

At some point, when a newer version of BoringSSL FIPS does support building QUIC,
this misuse of these options will almost certainly stop working. At that point,
we will need to fix the //bazel:http3=False option.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Simplified the use of OpenSSL 3.0.x in the build container
e7c7f01 
Eliminated the need for the openssl/do_ci.sh script, so the
upstream ci/do_ci.sh script should now be used directly instead.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Fixed SslSocketTest.Pkcs12CertificatesWithPassword test
e377272 
For this test to pass, it requires OpenSSL's legacy provider, so that the
RC2-40-CBC encryption algorithm is available. Previously, this was achieved
via an OpenSSL configuration file, pointed to by the OPENSSL_CONF env var,
which was set up in openssl/do_ci.sh script. But since the openssl/do_ci.sh
script no longer exists, we have to load (and unload) the legacy provider
programatically instead.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Disabled SslIntegrationTest.AsyncCertValidation* tests
8f15058 
Since we do not currently support async cert validation,
the following tests have been disabled:

SslIntegrationTest.AsyncCertValidationSucceeds
SslIntegrationTest.AsyncCertValidationSucceedsWithLocalAddress
SslIntegrationTest.AsyncCertValidationAfterTearDown
SslIntegrationTest.AsyncCertValidationAfterSslShutdown

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Reinstated private key method provider implementation and (disabled) …
b89df3e 
…tests

By making BoringSSL's ssl_private_key_method_st struct defintion, and a few
extra functions, available in bssl-compat, it is now possible to compile all of
Envoy's private key method provider mplementation and test code. The main
reason for this is to minimise the number of diffs wrt upstream.

Clearly, because the private key method provider mechanism isn't actually
implemented on OpenSSL, all the tests which actually excercise the private key
method provider will fail, so they are all disabled.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Always act as if we are building on a non-FIPS BoringSSL
d5a63be 
Switching OpenSSL between FIPS and non-FIPS is a config choice that is made
during deployment. Therefore, FIPS vs non-FIPS mode has no affect during build
time. Therefore the envoy-openssl binary has no concept of being built for one
mode or the other.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Fixed some test fingerprints & byte counts to match OpenSSL instead o…
2d2da58 
…f BoringSSL

Some tests check for things like JA3 fingerprints and/or received byte
counts, which vary between BoringSSL and OpenSSL due to slightly
different client hello contents etc.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Tidy up some bssl-compat compiler warnings
378ed68 
The ErrTest.test_SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM test was failing
to compile because it was referring to SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM
rather than the prefixed ossl_SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM.

The previously generated implementations of SSL_CTX_get_session_cache_mode()
and X509_STORE_CTX_get0_chain() have been replaced with hand written ones,
with the addition of some const casting to remove compiler warnings.

Finally, the OpenSSL version is increased from 3.0.8 to 3.0.13

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Allow SSL_CTX_set_verify() to receive a non-null callback parameter
2dcef9e 
A non-null callback was previously disallowed simply because there were no tests.
However, when building Envoy with google grpc, the callback capability is
required, and without it some of the grpc_client_integration_test fails.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
Swapnali911 and others added 29 commits October 18, 2024 11:27
@Swapnali911 @tedjpoole
Add missing changes for luajit2 on ppc64le
3ee67c9 
Signed-off-by: Swapnali911 <Swapnali.Pawar1@ibm.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Patch to remove hard coded -lcrypto from proxy-wasm-cpp-host on s390x
ba2142f 
The proxy-wasm-cpp-host BUILD file adds the -lcrypto option to the link line if
either --define=crypto=system is specified to bazel, or if building on s390x.
This effectively means that on s390x, the -lcrypto linker option is *always*
added and there's no way to remove it.

This updated patch removes that special s390x case, so that -lcrypto is *not*
added to the link line unless --define=crypto=system is specified, the same
as for all other architectures. In the context of envoy-openssl, this means
that proxy-wasm-cpp-host, along with everything else, gets linked against
libbssl-compat.a rather than libcrypto.so, which is what we need.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Adjust default TLS versions, ciphers & curves according to FIPS
a7f7e65 
Fixes OSSM-6786

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Fixed TLS alert code mapping in SSL_CTX_set_custom_verify()
083c655 
Also added a test

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Added EAGAIN handling in SslSocket::doRead/doWrite() methods
027205c 
Fixes OSSM-6809

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Removed "callback failed" error message from tls_inspector.cc
4b04531 
The TLS inspector listener filter installs a servername callback (using
SSL_CTX_set_tlsext_servername_callback()). That callback obtains the server
name and then halts the handshake by returning SSL_TLSEXT_ERR_ALERT_FATAL.
It does this because once it has obtained the server name, it has no need
to progress the handshake any further because it's only "peeking" at the
received data, and not actually doing the "real" handshake. In upstream
envoy, on BoringSSL, this is OK, but on OpenSSL the SSL_TLSEXT_ERR_ALERT_FATAL
return value causes a "callback failed" error message to be logged. It turns
out this error message is innocuous, but it is unsigtly and distracting, so
this commit removes it by returning SSL_TLSEXT_ERR_OK instead.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Tweak maxmind build
2a13c2a 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dgn @tedjpoole
Add new patch for jwt_verify_lib
3d45314 
The previous one did not apply to the new commit

Signed-off-by: Daniel Grimm <dgrimm@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Upstream code tweaking in BIO io_handle
2a20a96 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Uncomment layer function EC_KEY_set_public_key
ca24c17 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Add ECDSA_verify function to compat. layer
f207e28 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Remove compile errors in ssl_integration_test
5989379 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Align io_handle_bio to envoy-openssl
211bdcb 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Add necessary defines and functions to bssl layer
dcba756 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Replace opaque OpenSSL type "BIGNUM"
48fb039 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Comment unimplemented function in bssl Layer
e926378 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Manage split of context_config_impl.cc file
9a12697 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Clear compiler errors on quic libraries
eec7eef 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
RSA_check_key in bssl layer to solve the difference with boring when …
473a524 
…called in jwt_verify lib

Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Prevent failure of RevokedIntermediateCertificate
4bb21ac 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Workaround to prevent failure of tcp_grpc_access_log_integration_test
981a1ce 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@zmiklank @tedjpoole
temporarily disable hotrestart_handoff_test.py
1ab5e4f 
We will enable it with enabling quic support in envoy-openssl.

Signed-off-by: Zuzana Miklankova <zmiklank@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@dcillera @tedjpoole
Disable failing tests in aws_request_signing_integration
564c40c 
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Don't test @com_github_google_quiche//:ci_tests by default
f8ee420 
These quiche ci_tests currently fail to compile against the bssl-compat
layer, becasue it doesn't provide enough of the required BoringSSL API.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@zmiklank @tedjpoole
ServerContextConfig: set TLSv1.3 as max also for FIPS mode as default
24532e9 
Since https://bugzilla.redhat.com/show_bug.cgi?id=1724250 is already
fixed we can reenable TLSv1.3 for FIPS mode as a default max TLS server
version.

Signed-off-by: Zuzana Miklankova <zmiklank@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
Signed-off-by: Dario Cillerai <dcillera@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Added X509_get_ext_count() & X509_EXTENSION_get_object() to bssl-compat
e4c36bb 
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
s390x patch for datatype mismatch in valgrind
15b0eef 
Signed-off-by: Surender Yadav <root@m4228022.lnxero1.boe>
@Swapnali911 @tedjpoole
Disable cmake make Configuration Option
93eecf6 
Signed-off-by: swpawar <swpawar@redhat.com>
Signed-off-by: Ted Poole <tpoole@redhat.com>
@tedjpoole
Comment out cert_compression_test
2ad42eb 
OpenSSL 3.0.x doesn't implement certificate compression, so there's
no way we can implement the relevant bits of BoringSSL API in the
bssl-compat layer. Therefore, we comment out the associated test.

Signed-off-by: Ted Poole <tpoole@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
8 participants
@tedjpoole @dcillera @jwendell @dgn @surenderky @NishikantThorat @Swapnali911 @zmiklank