openssl/quictls support #1605

brbzull0 · 2023-08-29T10:57:36Z

Apache Traffic Server uses this library for handling the QUIC side of things of H3, as a part of this effort we plan to use quictls as the cryptography library, this is an effort(I work for Yahoo) to support that.

This PR includes all the previous work done in the openssl branch.

Design Notes

As some of the API are different between vendors, I have added two sub-modules to handle the specifics, for both, tls and the crypto module. The specifics of course are coded inside each submodule:
BoringSSL:

borinssl_crypto.rs
borinssl_tls.rs

OpenSSL/quictls:

openssl_quictls_crypto.rs
openssl_quictls_tls.rs

Each sub-module will be compiled depending on the feature you use (openssl or boringssl vendor) from the main module(tls, crypto).

Features

0-RTT Is not supported in this PR. It will be added afterwards. This is reflected in the README.

CI

we need to work around having openssl/quitls build and let quiche use it.
pkg-config seems not to be installed as build-dependency

Building notes for testing.

Make sure you have the openssl library in your LD_LIBRARY_PATH and the right path inside the PKG_CONFIG_PATH
Add openssl in the cargo --features list

I am using openssl/quictls 3 for this implementation.

brbzull0 · 2023-11-13T12:28:15Z

CI need to include openssl/quictls so we know we are passing all build/tests with the each vendor.

Eimji · 2024-01-06T05:44:06Z

Hello,

I am working on a mobile application which allows to use encrypted DNS (Android for the moment, iOS right after).
I tested quiche with a little proto on Android, it works great (thanks!). So I wanted to integrate quiche into my application to develop DoQ and DoH3, but I got compilation errors due to conflicts with OpenSSL. Yes, I use OpenSSL 3.2 to enable DoT and DoH.

It would be great if we can have a pluggable TLS vendor.

@brbzull0 As OpenSSL 3.2 supports now QUIC (not all features), your PR will support legacy OpenSSL > 3.2 or only quictls? Thanks for your work.

brbzull0 · 2024-01-11T13:29:14Z

Hello,

I am working on a mobile application which allows to use encrypted DNS (Android for the moment, iOS right after). I tested quiche with a little proto on Android, it works great (thanks!). So I wanted to integrate quiche into my application to develop DoQ and DoH3, but I got compilation errors due to conflicts with OpenSSL. Yes, I use OpenSSL 3.2 to enable DoT and DoH.

It would be great if we can have a pluggable TLS vendor.

@brbzull0 As OpenSSL 3.2 supports now QUIC (not all features), your PR will support legacy OpenSSL > 3.2 or only quictls? Thanks for your work.

Hello @Eimji . The plan is only quictls for now. Thanks for having a look

brbzull0 · 2024-01-11T13:29:56Z

Making this ready for review so we can gather some input. Thanks.

cc: @ghedo

brbzull0 · 2024-03-04T19:00:34Z

I think is worth having this link here, in case we want to discuss about it.

LPardue

A few nits but overall looks good

LPardue · 2024-03-12T18:00:51Z

quiche/src/crypto/boringssl.rs

+
+// NOTE: This structure is copied from <openssl/aead.h> in order to be able to
+// statically allocate it. While it is not often modified upstream, it needs to
+// be kept in sync.


Should we add the commit ID in the comment to make tracking more easy?

quiche/src/crypto/mod.rs

quiche/src/h3/mod.rs

LPardue · 2024-03-12T18:06:36Z

quiche/src/lib.rs

@@ -14311,7 +14327,9 @@ mod tests {
            })
        );
    }
-
+    // openssl does not provide a straight interface to deal with custom


Suggested change

// openssl does not provide a straight interface to deal with custom

// openssl does not provide a straightforward interface to deal with custom

LPardue · 2024-03-12T18:07:55Z

quiche/src/tls/openssl_quictls.rs

+
+impl Context {
+    pub fn set_early_data_enabled(&mut self, _enabled: bool) {
+        println!("## calling  set_early_data_enabled context!!")


hangover that needs cleanup. Probably a noop or maybe an assert?

brbzull0 · 2024-03-14T12:09:31Z

Saw that we need to rebase, I do not know if you guys are doing anything with this branch so I do not want to force push a and break anything on your side.
Can I go ahead and rebae & force push?

Thanks.

This adds support for building against the "quictls" fork of OpenSSL instead of BoringSSL, to provide crypto and TLS support. Because upstream OpenSSL doesn't (yet?) expose an API for implementing the QUIC handshake, like BoringSSL does, a fork of it was created called quictls. This functionality can be useful for applications that already use OpenSSL and where adding BoringSSL on top would create conflicts.

ghedo · 2024-03-16T05:42:31Z

@brbzull0 I was going to do it, just got delayed by travel. Thanks for your work, this is merged now!

brbzull0 · 2024-03-18T09:11:59Z

@brbzull0 I was going to do it, just got delayed by travel. Thanks for your work, this is merged now!

great stuff!
@ghedo @LPardue Thanks a lot gents!

brbzull0 changed the title ~~openssl/quictls support WIP~~ openssl/quictls support WIP (continuation) Aug 29, 2023

brbzull0 force-pushed the openssl-dev-wip branch from dd81708 to d58b78b Compare August 29, 2023 14:55

brbzull0 changed the title ~~openssl/quictls support WIP (continuation)~~ openssl/quictls support (continuation) Sep 4, 2023

brbzull0 force-pushed the openssl-dev-wip branch 3 times, most recently from 4e32bfe to cc31d17 Compare September 12, 2023 09:10

brbzull0 mentioned this pull request Sep 12, 2023

CI builds with openssl/quictls #1614

Open

brbzull0 force-pushed the openssl-dev-wip branch from f9ff208 to a9b8c60 Compare September 19, 2023 13:49

brbzull0 force-pushed the openssl-dev-wip branch from a9b8c60 to e51d161 Compare October 24, 2023 13:46

brbzull0 force-pushed the openssl-dev-wip branch 7 times, most recently from ffc4e32 to 9014cf9 Compare November 13, 2023 11:09

brbzull0 changed the title ~~openssl/quictls support (continuation)~~ openssl/quictls support Nov 13, 2023

brbzull0 mentioned this pull request Nov 30, 2023

Update build h3 script to have the option to build quiche with openssl/quictls apache/trafficserver#10873

Closed

brbzull0 force-pushed the openssl-dev-wip branch from 9014cf9 to b51acaa Compare December 14, 2023 16:38

brbzull0 force-pushed the openssl-dev-wip branch 4 times, most recently from 760c487 to 8294a7a Compare January 11, 2024 11:21

brbzull0 marked this pull request as ready for review January 11, 2024 13:29

brbzull0 requested a review from a team as a code owner January 11, 2024 13:29

brbzull0 force-pushed the openssl-dev-wip branch from 8294a7a to 22ae11b Compare February 20, 2024 10:05

brbzull0 mentioned this pull request Feb 20, 2024

nightly build seems to be failing. #1723

Closed

brbzull0 force-pushed the openssl-dev-wip branch from 22ae11b to 3bc498b Compare February 23, 2024 08:43

ghedo force-pushed the openssl-dev-wip branch 4 times, most recently from ad391cc to 9cd57ae Compare March 12, 2024 16:28

ghedo previously approved these changes Mar 12, 2024

View reviewed changes

LPardue requested changes Mar 12, 2024

View reviewed changes

ghedo dismissed their stale review via b6af196 March 12, 2024 18:15

brbzull0 force-pushed the openssl-dev-wip branch 2 times, most recently from 98c5ba4 to 0ce9d56 Compare March 15, 2024 13:44

ghedo force-pushed the openssl-dev-wip branch from 0ce9d56 to 2e076b5 Compare March 16, 2024 04:56

ghedo approved these changes Mar 16, 2024

View reviewed changes

LPardue approved these changes Mar 16, 2024

View reviewed changes

ghedo merged commit 53dc0cc into cloudflare:master Mar 16, 2024
25 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

openssl/quictls support #1605

openssl/quictls support #1605

brbzull0 commented Aug 29, 2023 •

edited

Loading

brbzull0 commented Nov 13, 2023

Eimji commented Jan 6, 2024

brbzull0 commented Jan 11, 2024

brbzull0 commented Jan 11, 2024 •

edited

Loading

brbzull0 commented Mar 4, 2024

LPardue left a comment

LPardue Mar 12, 2024

LPardue Mar 12, 2024

LPardue Mar 12, 2024

brbzull0 commented Mar 14, 2024

ghedo commented Mar 16, 2024

brbzull0 commented Mar 18, 2024

	// openssl does not provide a straight interface to deal with custom
	// openssl does not provide a straightforward interface to deal with custom

openssl/quictls support #1605

openssl/quictls support #1605

Conversation

brbzull0 commented Aug 29, 2023 • edited Loading

Design Notes

Features

CI

Building notes for testing.

brbzull0 commented Nov 13, 2023

Eimji commented Jan 6, 2024

brbzull0 commented Jan 11, 2024

brbzull0 commented Jan 11, 2024 • edited Loading

brbzull0 commented Mar 4, 2024

LPardue left a comment

Choose a reason for hiding this comment

LPardue Mar 12, 2024

Choose a reason for hiding this comment

LPardue Mar 12, 2024

Choose a reason for hiding this comment

LPardue Mar 12, 2024

Choose a reason for hiding this comment

brbzull0 commented Mar 14, 2024

ghedo commented Mar 16, 2024

brbzull0 commented Mar 18, 2024

brbzull0 commented Aug 29, 2023 •

edited

Loading

brbzull0 commented Jan 11, 2024 •

edited

Loading