Wolf ssl

[thiagoftsm]

Summary

Fixes #6509

This PR fixes the issue #6509 bringing support for WolfSSL library, the code also brings some changes on our code for one day Netdata becomes completely independent of OpenSSL, but this is not possible now, because WolfSSL does not have all features that OpenSSL according their documentation.

Component Name

WebServer
DBengine
ACLK
installer

Test Plan

1 - Compile wolfssl on a system that does not have exporters like graphana, kinesis, mongodb or pubsub, because they can be linked against OpenSSL:

unzip wolfssl-master.zip
./autogen.sh
./configure --prefix=/usr --enable-all --enable-static
make
make install

These steps will install the libraries at /usr/lib/, that is the official directory of OpenWRT, but for some distributions, it will be necessary to create a symbolic link at /usr/lib64/.

2 - Execute the following tests with this PR:

All tests (Except dbengine)

On parent:

• Compile the PR with options '--use-wolfssl', '--disable-cloud', '--disable-dbengine'.
• Verify that Netdata was linked only with wolfssl
• Create the pair certificate and key, and move your files to the correct destination.
• Force connection with tls
• Configure Stream
• Configure exporting.conf to send data for an external storage.
• Start Netdata.
• Access Netdata dashboard.

On child:

• Compile the PR with options '--use-wolfssl', '--disable-cloud', '--disable-dbengine'.
• Configure Stream
• Start Netdata

Dbengine and cloud

On parent:

• Compile the PR with options '--use-wolfssl'
• Configure your netdata.conf to use memory mode = dbengine.
• Start Netdata

We won't have cloud working, because libwebsockets does not recognize a necessary function that was renamed by WolfSSL, but we should have dbengine working without problems.

Everything is working when compiled against OpenSSL

• Compile this PR without the option --use-wolfssl. Everything will work, including the cloud.

Additional Information

WolfSSL is not in the same level that OpenSSL is right now, and this is explicit in their documentation, but without any doubts we can generate smaller binaries with it.

Scenario	options	Expected
both, OpenSSL and wolfSSL are installed	'--use-wolfssl'	Netdata will be linked only against WolfSSL and everything except the cloud must work.
both, OpenSSL and wolfSSL are installed		Netdata will be linked only against OpenSSL and everything must work.
only OpenSSL is installed.	for any combination	everything needs to work, because Netdata will be linked against OpenSSL
only WolfSSL is installed.	for any combination	Cloud won't work, but the rest should work.

[thiagoftsm]

This PR is set to draft until the documentation to be adjusted.

[vlvkobal]

There is a problem with CentOS 7 and Ubuntu 16.04 in our CI

  CC       libnetdata/socket/security.o
In file included from libnetdata/socket/../socket/security.h:27:0,
                 from libnetdata/socket/../libnetdata.h:314,
                 from libnetdata/socket/security.c:1:
libnetdata/socket/security.c:120:5: error: expected declaration specifiers or '...' before '(' token
     SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
     ^
In file included from libnetdata/socket/../socket/security.h:27:0,
                 from libnetdata/socket/../libnetdata.h:314,
                 from libnetdata/socket/security.c:1:
libnetdata/socket/security.c:120:5: error: expected declaration specifiers or '...' before numeric constant
     SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
     ^
In file included from libnetdata/socket/../socket/security.h:27:0,
                 from libnetdata/socket/../libnetdata.h:314,
                 from libnetdata/socket/security.c:1:
libnetdata/socket/security.c:120:5: error: expected declaration specifiers or '...' before '(' token
     SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
     ^
In file included from /usr/include/x86_64-linux-gnu/sys/param.h:23:0,
                 from /usr/include/resolv.h:62,
                 from libnetdata/socket/../libnetdata.h:98,
                 from libnetdata/socket/security.c:1:
libnetdata/socket/security.c:120:5: error: expected declaration specifiers or '...' before '(' token
     SSL_CTX_set_mode(ctx, SSL_MODE_ACCEPT_MOVING_WRITE_BUFFER);
     ^
libnetdata/socket/security.c:121:1: error: expected identifier or '(' before '}' token
 }
 ^
Makefile:4579: recipe for target 'libnetdata/socket/security.o' failed
make[2]: *** [libnetdata/socket/security.o] Error 1
make[2]: *** Waiting for unfinished jobs....
make[2]: Leaving directory '/netdata'
make[1]: *** [all-recursive] Error 1
Makefile:5261: recipe for target 'all-recursive' failed
make[1]: Leaving directory '/netdata'
make: *** [all] Error 2
Makefile:2744: recipe for target 'all' failed
Error: Process completed with exit code 2.

[vlvkobal]

There are a lot of warnings in config.log:

conftest.c:70: warning: "HAVE_X509_VERIFY_PARAM_set1_host" redefined
   70 | #define HAVE_X509_VERIFY_PARAM_set1_host 1
      |
conftest.c:68: note: this is the location of the previous definition
   68 | #define HAVE_X509_VERIFY_PARAM_set1_host 0
      |

[vlvkobal]

Please test your PR with all combinations of installed SSL libraries.

• only OpenSSL is installed.
  • with '--use-wolfssl'.
  • without '--use-wolfssl'.
• only wolfSSL is installed.
  • with '--use-wolfssl'.
  • without '--use-wolfssl'.
• both, OpenSSL and wolfSSL are installed
  • with '--use-wolfssl'.
  • without '--use-wolfssl'.

Please describe the behavior of the '--use-wolfssl' flag.

[thiagoftsm]

There are a lot of warnings in config.log:

conftest.c:70: warning: "HAVE_X509_VERIFY_PARAM_set1_host" redefined
   70 | #define HAVE_X509_VERIFY_PARAM_set1_host 1
      |
conftest.c:68: note: this is the location of the previous definition
   68 | #define HAVE_X509_VERIFY_PARAM_set1_host 0
      |

I removed completely the test for the function when wolf_ssl is used, because it has problems when linked against libwebsockets.

[thiagoftsm]

Please test your PR with all combinations of installed SSL libraries.

* only OpenSSL is installed.
  
  * with '--use-wolfssl'.
  * without '--use-wolfssl'.

* only wolfSSL is installed.
  
  * with '--use-wolfssl'.
  * without '--use-wolfssl'.

* both, OpenSSL and wolfSSL are installed
  
  * with '--use-wolfssl'.
  * without '--use-wolfssl'.

Please describe the behavior of the '--use-wolfssl' flag.

I updated the OP with the expected results.

[thiagoftsm]

I am closing this PR, and I will start another with the current master branch.