Skip to content

openssl+gnutls, use shared code for TCP+QUIC - #13172

Closed
icing wants to merge 13 commits into
curl:masterfrom
icing:ossl-ctx-sync-tcp-quic
Closed

openssl+gnutls, use shared code for TCP+QUIC#13172
icing wants to merge 13 commits into
curl:masterfrom
icing:ossl-ctx-sync-tcp-quic

Conversation

@icing

@icing icing commented Mar 22, 2024

Copy link
Copy Markdown
Contributor

Having TCP TLS and QUIC TLS use shared code.

  • OpenSSL TCP+QUIC filters now have a common init and cert verify.
  • gnuTLS with common init and verify
  • SSL session storage also used in QUIC Openssl filter
  • struct ssl_peer has added port and transport members
  • peer is passed in session lookup and storage
  • sessions only used when transport matches

@icing
icing force-pushed the ossl-ctx-sync-tcp-quic branch from 20ff46c to 44b4eac Compare March 25, 2024 13:05
@github-actions github-actions Bot added the tests label Mar 25, 2024
@icing icing changed the title openssl, use shared init code for TCP+QUIC openssl, use shared code for TCP+QUIC Mar 25, 2024
@icing
icing force-pushed the ossl-ctx-sync-tcp-quic branch from d8dcf2c to 7c4c504 Compare March 26, 2024 12:12
@icing icing changed the title openssl, use shared code for TCP+QUIC openssl+gnutls, use shared code for TCP+QUIC Mar 26, 2024
@bagder

bagder commented Apr 4, 2024

Copy link
Copy Markdown
Member

merge conflicts

icing added 13 commits April 4, 2024 12:20
- session handling is not activated for QUIC, needs
  a bit more work
- configured ssl version is ignore in QUIC, should
  check and error, todo
- add `port` and `transport` to `struct ssl_peer`
- pass peer to session lookup and storage
- rewire openssl session callbacks differently for
  TCP and QUIC filters
- add new peer params in vaious backends
- gnutls, common init code
- openssl, common cert verify code
- fixes builds with gnutls but without ngtcp2
@icing
icing force-pushed the ossl-ctx-sync-tcp-quic branch from 86318df to bb91a33 Compare April 4, 2024 10:22
@bagder bagder closed this in 3210101 Apr 9, 2024
@vszakats

vszakats commented Apr 9, 2024

Copy link
Copy Markdown
Member

Seems to fail permanently with old linux:

/__w/curl/curl/lib/vtls/openssl.c: In function 'Curl_ossl_ctx_init':
/__w/curl/curl/lib/vtls/openssl.c:3556:18: error: implicit declaration of function 'TLS_method' [-Werror=implicit-function-declaration]
     req_method = TLS_method();
                  ^~~~~~~~~~
/__w/curl/curl/lib/vtls/openssl.c:3556:5: error: nested extern declaration of 'TLS_method' [-Werror=nested-externs]
     req_method = TLS_method();
     ^~~~~~~~~~
/__w/curl/curl/lib/vtls/openssl.c:3556:16: error: assignment makes pointer from integer without a cast [-Werror=int-conversion]
     req_method = TLS_method();
                ^
/__w/curl/curl/lib/vtls/openssl.c: In function 'ossl_connect_step2':
/__w/curl/curl/lib/vtls/openssl.c:3955:38: error: cannot take address of bit-field 'keylog_done'
     ossl_log_tls12_secret(octx->ssl, &octx->keylog_done);
                                      ^

Ref: https://github.com/curl/curl/actions/runs/8611712426/job/23599433148#step:6:207

@icing

icing commented Apr 9, 2024

Copy link
Copy Markdown
Contributor Author

Thanks, that somehow flew by. Fix in #13325.

vszakats added a commit that referenced this pull request Apr 10, 2024
Visible in daily curl-for-win builds:
https://github.com/curl/curl-for-win/actions/runs/8621925870

```
lib/vquic/curl_ngtcp2.c:1916:12: error: redefinition of 'ossl_new_session_cb'
static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
           ^
lib/vtls/openssl.c:2978:12: note: previous definition is here
static int ossl_new_session_cb(SSL *ssl, SSL_SESSION *ssl_sessionid)
           ^
```
https://github.com/curl/curl-for-win/actions/runs/8621925870/job/23631885439#step:3:6965

Follow-up to 3210101 #13172
Closes #13332
vszakats added a commit that referenced this pull request Jan 28, 2025
Before this patch this macro was used in `vtls/openssl.h` without
setting it first, causing the `keylog_done` member be present in
struct `ossl_ctx` while the code did not use it.

Follow-up to 3210101 #13172
Closes #16105
pps83 pushed a commit to pps83/curl that referenced this pull request Apr 26, 2025
Before this patch this macro was used in `vtls/openssl.h` without
setting it first, causing the `keylog_done` member be present in
struct `ossl_ctx` while the code did not use it.

Follow-up to 3210101 curl#13172
Closes curl#16105
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Development

Successfully merging this pull request may close these issues.

3 participants