ALPN function definition issues

[RvdE]

Since upgrading my LibreSSL to 2.1.3, py-cryptography no longer builds. This is caused by the definition of the ALPN functions in ssl.py, which is different than the ones from ssl.h. The same is true for OpenSSL, since the ALPN implementation seems to be shared between the two (perhaps with minor differences in the code, but the header looks the same).

[reaperhulk]

What definition difference are you seeing? OpenSSL's definitions (https://github.com/openssl/openssl/blob/master/ssl/ssl.h#L1284) match our bindings (https://github.com/pyca/cryptography/blob/master/src/cryptography/hazmat/bindings/openssl/ssl.py#L357) from what I can see.

If Libre is defining them differently that's obviously an issue, but at this time we're not officially supporting Libre (there is a tentative plan to fork the openssl backend so we can remove things like engine support from the libre code).

[RvdE]

From LibreSSL 2.1.3 ssl.h:
int SSL_CTX_set_alpn_protos(SSL_CTX _ctx, const unsigned char *protos,
unsigned int protos_len);
int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
unsigned int protos_len);
void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
int (_cb)(SSL _ssl, const unsigned char *_out, unsigned char _outlen,
const unsigned char *in, unsigned int inlen, void *arg), void *arg);
void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char *_data,
unsigned int *len);

From OpenSSL 1.0.2 (tarball) ssl.h:
int SSL_CTX_set_alpn_protos(SSL_CTX _ctx, const unsigned char *protos,
unsigned protos_len);
int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
unsigned protos_len);
void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
int (_cb) (SSL _ssl,
const unsigned char *_out,
unsigned char _outlen,
const unsigned char *in,
unsigned int inlen,
void *arg), void *arg);
void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char *_data,
unsigned *len);

Except for some layout differences, those are the same.

From py-cryptography 0.7.2:
int SSL_CTX_set_alpn_protos(SSL_CTX , const unsigned char *, unsigned);
int SSL_set_alpn_protos(SSL *, const unsigned char *, unsigned);
void SSL_CTX_set_alpn_select_cb(SSL_CTX *,
int () (SSL ,
const unsigned char *,
unsigned char ,
const unsigned char *,
unsigned int,
void *),
void *);
void SSL_get0_alpn_selected(const SSL *, const unsigned char *, unsigned *);

The differences I'm seeing are 'SSL *ssl' (Libre/OpenSSL) vs. 'SSL *' and 'const unsigned char *protos' vs 'const unsigned char *'.

This causes the following building errors:
src/cryptography/hazmat/bindings/pycache/_Cryptography_cffi_f77e154ax78a85b26.c:2081:7: error: redefinition of 'SSL_CTX_set_alpn_protos' as different kind of symbol
int (*SSL_CTX_set_alpn_protos)(SSL_CTX *,
^
/usr/local/include/openssl/ssl.h:981:5: note: previous definition is here
int SSL_CTX_set_alpn_protos(SSL_CTX *ctx, const unsigned char *protos,
^
src/cryptography/hazmat/bindings/pycache/_Cryptography_cffi_f77e154ax78a85b26.c:2084:7: error: redefinition of 'SSL_set_alpn_protos' as different kind of symbol
int (*SSL_set_alpn_protos)(SSL *, const unsigned char *, unsigned) = NULL;
^
/usr/local/include/openssl/ssl.h:983:5: note: previous definition is here
int SSL_set_alpn_protos(SSL *ssl, const unsigned char *protos,
^
src/cryptography/hazmat/bindings/pycache/_Cryptography_cffi_f77e154ax78a85b26.c:2085:8: error: redefinition of 'SSL_CTX_set_alpn_select_cb' as different kind of symbol
void (*SSL_CTX_set_alpn_select_cb)(SSL_CTX *,
^
/usr/local/include/openssl/ssl.h:985:6: note: previous definition is here
void SSL_CTX_set_alpn_select_cb(SSL_CTX *ctx,
^
src/cryptography/hazmat/bindings/pycache/_Cryptography_cffi_f77e154ax78a85b26.c:2093:8: error: redefinition of 'SSL_get0_alpn_selected' as different kind of symbol
void (_SSL_get0_alpn_selected)(const SSL *,
^
/usr/local/include/openssl/ssl.h:988:6: note: previous definition is here
void SSL_get0_alpn_selected(const SSL *ssl, const unsigned char *_data,
^

[reaperhulk]

@RvdE In C you can elide the parameter name and the function declaration is identical. The actual problem here is that the OpenSSL backend for cryptography does feature detection based on OPENSSL_VERSION_NUMBER being >= 0x10002001L (see line 527 of src/cryptography/hazmat/bindings/openssl/ssl.py). This could be fixed by checking the Libre version number as well, but at the moment we're not accepting patches for libre against the openssl backend for the reason I previously mentioned.

[RvdE]

Thanks for the explanation. This will soon no longer be an issue for me since somebody patched it for FreeBSD.

[reaperhulk]

As of today we test master against libressl portable 2.1.3 and all tests pass.