Skip to content

Commit

Permalink
tls_wolfssl: clean-up; remove OpenSSL-isms
Browse files Browse the repository at this point in the history
  • Loading branch information
@space88man
space88man committed Jan 24, 2024
1 parent 33b2e51 commit 3d0e752
Show file tree
Hide file tree
Showing 14 changed files with 78 additions and 611 deletions.
8 changes: 0 additions & 8 deletions src/modules/tls_wolfssl/tls_cfg.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -60,8 +60,6 @@ struct cfg_group_tls default_tls_cfg = {
-1, /* ssl_max_send_fragment (use the default: 16k), requires openssl
> 0.9.9 */
0, /* ssl_read_ahead (off, not needed, we have our own buffering BIO)*/
-1, /* low_mem_threshold1 */
-1, /* low_mem_threshold2 */
10 * 1024 * 1024, /* ct_wq_max: 10 Mb by default */
64 * 1024, /* con_ct_wq_max: 64Kb by default */
4096, /* ct_wq_blk_size */
Expand Down Expand Up @@ -200,12 +198,6 @@ cfg_def_t tls_cfg_def[] = {{"force_run", CFG_VAR_INT | CFG_READONLY, 0, 1, 0, 0,
" module versions it is better to have read ahead disabled, "
"since"
" everything it is buffered in memory anyway"},
{"low_mem_threshold1", CFG_VAR_INT | CFG_ATOMIC, -1, 1 << 30, 0, 0,
"sets the minimum amount of free memory for accepting new TLS"
" connections (KB)"},
{"low_mem_threshold2", CFG_VAR_INT | CFG_ATOMIC, -1, 1 << 30, 0, 0,
"sets the minimum amount of free memory after which no more TLS"
" operations will be attempted (even on existing connections)"},
{"ct_wq_max", CFG_VAR_INT | CFG_ATOMIC, 0, 1 << 30, 0, 0,
"maximum bytes queued globally for write when write has to "
"wait due"
Expand Down
2 changes: 0 additions & 2 deletions src/modules/tls_wolfssl/tls_cfg.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -90,8 +90,6 @@ struct cfg_group_tls
* now)
*/
int ssl_read_ahead;
int low_mem_threshold1;
int low_mem_threshold2;
int ct_wq_max; /* maximum overall tls write clear text queued bytes */
int con_ct_wq_max; /* maximum clear text write queued bytes per con */
int ct_wq_blk_size; /* minimum block size for the clear text write queue */
Expand Down
43 changes: 10 additions & 33 deletions src/modules/tls_wolfssl/tls_domain.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -598,8 +598,8 @@ static int load_crl(tls_domain_t *d)
return -1;
}
store = wolfSSL_CTX_get_cert_store(d->ctx[0]);
X509_STORE_set_flags(
store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
wolfSSL_X509_STORE_set_flags(
store, WOLFSSL_CRL_CHECK | WOLFSSL_CRL_CHECKALL);
}while(0);
return 0;
}
Expand All @@ -621,27 +621,6 @@ static int set_cipher_list(tls_domain_t *d)
char *cipher_list;

cipher_list = d->cipher_list.s;
#ifdef TLS_KSSL_WORKAROUND
if(openssl_kssl_malloc_bug) { /* is openssl bug #1467 present ? */
if(d->cipher_list.s == 0) {
/* use "DEFAULT:!KRB5" */
cipher_list = "DEFAULT:!KRB5";
} else {
/* append ":!KRB5" */
cipher_list =
shm_malloc(d->cipher_list.len + C_NO_KRB5_SUFFIX_LEN + 1);
if(cipher_list) {
memcpy(cipher_list, d->cipher_list.s, d->cipher_list.len);
memcpy(cipher_list + d->cipher_list.len, C_NO_KRB5_SUFFIX,
C_NO_KRB5_SUFFIX_LEN);
cipher_list[d->cipher_list.len + C_NO_KRB5_SUFFIX_LEN] = 0;
shm_free(d->cipher_list.s);
d->cipher_list.s = cipher_list;
d->cipher_list.len += C_NO_KRB5_SUFFIX_LEN;
}
}
}
#endif /* TLS_KSSL_WORKAROUND */
if(!cipher_list)
return 0;

Expand Down Expand Up @@ -749,9 +728,9 @@ static int set_ssl_options(tls_domain_t *d)
{
long options;

options = SSL_OP_ALL; /* all the bug workarounds by default */
options |= SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
| SSL_OP_CIPHER_SERVER_PREFERENCE;
options = WOLFSSL_OP_ALL; /* all the bug workarounds by default */

This comment has been minimized.

Sign in to view

Copy link
@linuxmaniac

linuxmaniac Jan 30, 2024

Member

This broke the build on jammy https://kamailio.sipwise.com/job/kamailiodev-nightly-binaries/architecture=amd64,distribution=jammy/2586/display/redirect

libwolfssl32_5.2.0-2_amd64.deb

gcc -fPIC -DPIC -funroll-loops -Wcast-align -m64 -minline-all-stringops -falign-loops -ftree-vectorize -fno-strict-overflow -mtune=generic -pthread -DKSR_PTHREAD_MUTEX_SHARED -Wall -Wdate-time -D_FORTIFY_SOURCE=2 -g -O2 -ffile-prefix-map=/build/kamailio-5.8.0~dev2+ubuntu22.04.20240130005413.2609=. -flto=auto -ffat-lto-objects -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -DVERSION_NODATE   -DNAME='"kamailio"' -DVERSION='"5.8.0-dev2"' -DARCH='"x86_64"' -DOS='linux_' -DOS_QUOTED='"linux"' -DCOMPILER='"gcc 11.4.0"' -D__CPU_x86_64 -D__OS_linux -DVERSIONVAL=5008000 -DCFG_DIR='"/etc/kamailio/"' -DSHARE_DIR='"/usr/share/kamailio/"' -DRUN_DIR='"/var/run/kamailio/"' -DPKG_MALLOC -DSHM_MMAP -DDNS_IP_HACK -DUSE_MCAST -DUSE_TCP -DDISABLE_NAGLE -DHAVE_RESOLV_RES -DUSE_DNS_CACHE -DUSE_DNS_FAILOVER -DUSE_DST_BLOCKLIST -DUSE_NAPTR -DMEM_JOIN_FREE -DF_MALLOC -DQ_MALLOC -DTLSF_MALLOC -DDBG_SR_MEMORY -DUSE_TLS -DTLS_HOOKS -DUSE_CORE_STATS -DSTATISTICS -DMALLOC_STATS -DUSE_SCTP -DFAST_LOCK -DADAPTIVE_WAIT -DADAPTIVE_WAIT_LOOPS=1024 -DCC_GCC_LIKE_ASM -DHAVE_GETHOSTBYNAME2 -DHAVE_UNION_SEMUN -DHAVE_SCHED_YIELD -DHAVE_MSG_NOSIGNAL -DHAVE_MSGHDR_MSG_CONTROL -DHAVE_ALLOCA_H -DHAVE_TIMEGM -DHAVE_SCHED_SETSCHEDULER -DHAVE_IP_MREQN -DUSE_RAW_SOCKS -DHAVE_EPOLL -DHAVE_SIGIO_RT -DSIGINFO64_WORKAROUND -DUSE_FUTEX -DHAVE_SELECT  -DMOD_NAME='"tls_wolfssl"' -DMOD_NAMEID='tls_wolfssl' -c tls_domain.c -o tls_domain.o -MMD -MP
tls_domain.c: In function 'set_ssl_options':
tls_domain.c:731:19: error: 'WOLFSSL_OP_ALL' undeclared (first use in this function); did you mean 'SSL_OP_ALL'?
  731 |         options = WOLFSSL_OP_ALL; /* all the bug workarounds by default */
      |                   ^~~~~~~~~~~~~~
      |                   SSL_OP_ALL
tls_domain.c:731:19: note: each undeclared identifier is reported only once for each function it appears in
tls_domain.c:732:20: error: 'WOLFSSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION' undeclared (first use in this function); did you mean 'SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION'?
  732 |         options |= WOLFSSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
      |                    ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
      |                    SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
make[3]: *** [../../Makefile.rules:100: tls_domain.o] Error 1
make[2]: *** [Makefile:508: modules] Error 1
make[2]: Leaving directory '/build/kamailio-5.8.0~dev2+ubuntu22.04.20240130005413.2609/src'
make[1]: *** [Makefile:34: every-module] Error 2
make[1]: Leaving directory '/build/kamailio-5.8.0~dev2+ubuntu22.04.20240130005413.2609'
make: *** [debian/rules:133: build_tls_wolfssl] Error 2
options |= WOLFSSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION
| WOLFSSL_OP_CIPHER_SERVER_PREFERENCE;

do {
wolfSSL_CTX_set_options(d->ctx[0], options);
Expand All @@ -778,8 +757,8 @@ static int set_session_cache(tls_domain_t *d)
* thus sessions among processes will not be reused
*/
wolfSSL_CTX_set_session_cache_mode(d->ctx[0],
cfg_get(tls, tls_cfg, session_cache) ? SSL_SESS_CACHE_SERVER
: SSL_SESS_CACHE_OFF);
cfg_get(tls, tls_cfg, session_cache) ? WOLFSSL_SESS_CACHE_SERVER
: WOLFSSL_SESS_CACHE_OFF);
/* not really needed is SSL_SESS_CACHE_OFF */
wolfSSL_CTX_set_session_id_context(d->ctx[0],
(unsigned char *)tls_session_id.s, tls_session_id.len);
Expand Down Expand Up @@ -815,6 +794,7 @@ static int tls_ssl_ctx_mode(WOLFSSL_CTX *ctx, long mode, void *clear)
*/
static int tls_ssl_ctx_set_freelist(WOLFSSL_CTX *ctx, long val, void *unused)
{
/* NOOP */
return 0;
}

Expand All @@ -828,10 +808,7 @@ static int tls_ssl_ctx_set_freelist(WOLFSSL_CTX *ctx, long val, void *unused)
static int tls_ssl_ctx_set_max_send_fragment(
WOLFSSL_CTX *ctx, long val, void *unused)
{
/* WOLFFIX if (val >= 0)
return SSL_CTX_set_max_send_fragment(ctx, val) -1;
*/

/* NOOP */
return 0;
}

Expand Down Expand Up @@ -863,7 +840,7 @@ static int tls_server_name_cb(SSL *ssl, int *ad, void *private)

orig_domain = (tls_domain_t *)private;
server_name.s =
(char *)wolfSSL_get_servername(ssl, TLSEXT_NAMETYPE_host_name);
(char *)wolfSSL_get_servername(ssl, WOLFSSL_SNI_HOST_NAME);
if(server_name.s) {
LM_DBG("received server_name (TLS extension): '%s'\n", server_name.s);
} else {
Expand Down
170 changes: 0 additions & 170 deletions src/modules/tls_wolfssl/tls_dump_vf.c
View file

This file was deleted.

41 changes: 0 additions & 41 deletions src/modules/tls_wolfssl/tls_dump_vf.h
View file

This file was deleted.

0 comments on commit 3d0e752

Please sign in to comment.