Skip to content

Commit

Permalink
QUIC: Add support for BoringSSL QUIC APIs
Browse files Browse the repository at this point in the history
This adds a compatible API for BoringSSL's QUIC support, based
on the current |draft-ietf-quic-tls|.

Based on BoringSSL commit 3c034b2cf386b3131f75520705491871a2e0cafe
Based on BoringSSL commit c8e0f90f83b9ec38ea833deb86b5a41360b62b6a
Based on BoringSSL commit 3cbb0299a28a8bd0136257251a78b91a96c5eec8
Based on BoringSSL commit cc9d935256539af2d3b7f831abf57c0d685ffd81
Based on BoringSSL commit e6eef1ca16a022e476bbaedffef044597cfc8f4b
Based on BoringSSL commit 6f733791148cf8a076bf0e95498235aadbe5926d
Based on BoringSSL commit 384d0eaf1930af1ebc47eda751f0c78dfcba1c03
Based on BoringSSL commit a0373182eb5cc7b81d49f434596b473c7801c942
Based on BoringSSL commit b1b76aee3cb43ce11889403c5334283d951ebd37
  • Loading branch information
tmshort authored and Watson Ladd committed May 9, 2024
1 parent 4cb3112 commit 9f3c339
Show file tree
Hide file tree
Showing 42 changed files with 2,502 additions and 315 deletions.
54 changes: 18 additions & 36 deletions .github/workflows/fips-checksums.yml
Original file line number Diff line number Diff line change
Expand Up @@ -73,47 +73,29 @@ jobs:
with:
name: fips_checksum
path: artifact/

compute-abidiff:
verify-checksums:
runs-on: ubuntu-latest
env:
BUILD_OPTS: -g --strict-warnings enable-ktls enable-fips enable-egd enable-ec_nistp_64_gcc_128 enable-md2 enable-rc5 enable-sctp enable-ssl3 enable-ssl3-method enable-trace enable-zlib enable-zstd
steps:
- name: install unifdef
run: |
sudo apt-get update
sudo apt-get -yq --no-install-suggests --no-install-recommends --force-yes install unifdef
- uses: actions/checkout@v2
- name: create build dirs
run: |
mkdir ./build-pristine
mkdir ./source-pristine
mkdir ./build
mkdir ./source
mkdir ./artifact
- name: install extra config support
run: sudo apt-get -y install libsctp-dev abigail-tools libzstd-dev zstd
- uses: actions/checkout@v4
with:
repository: ${{ github.event.pull_request.base.repo.full_name }}
ref: ${{ github.event.pull_request.base.ref }}
path: source-pristine
- name: config pristine
run: ../source-pristine/config --banner=Configured $BUILD_OPTS && perl configdata.pm --dump
working-directory: ./build-pristine
- name: make pristine
run: make -s -j4
working-directory: ./build-pristine
- uses: actions/checkout@v4
with:
path: source
- name: config
run: ../source/config --banner=Configured $BUILD_OPTS && perl configdata.pm --dump
run: ../config enable-fips && perl configdata.pm --dump
working-directory: ./build
- name: make
run: make -s -j4
- name: make build_generated
run: make -s build_generated
working-directory: ./build
- name: make fips-checksums
run: make fips-checksums
working-directory: ./build
- name: make fips-checksums
run: make fips-checksums
working-directory: ./build
- name: make diff-fips-checksums
run: make diff-fips-checksums
working-directory: ./build
- name: abidiff
run: abidiff --headers-dir1 build-pristine/include/openssl --headers-dir2 build/include/openssl --drop-private-types ./build-pristine/libcrypto.so ./build/libcrypto.so && abidiff --headers-dir1 build-pristine/include/openssl --headers-dir2 build/include/openssl --drop-private-types ./build-pristine/libssl.so ./build/libssl.so && touch ./artifact/abi_unchanged || ( touch ./artifact/abi_changed ; echo ABI CHANGED )
- name: save PR number
run: echo ${{ github.event.number }} > ./artifact/pr_num
- name: save artifact
uses: actions/upload-artifact@v3
with:
name: abidiff
path: artifact/
5 changes: 5 additions & 0 deletions CHANGES.md
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,11 @@ OpenSSL Releases
OpenSSL 3.3
-----------

### Changes Between 3.3.0 and 3.3.0+quic
* Add QUIC API support from BoringSSL

*Todd Short*

### Changes between 3.2 and 3.3.0 [9 Apr 2024]

* The `-verify` option to the `openssl crl` and `openssl req` will make
Expand Down
13 changes: 11 additions & 2 deletions Configure
Original file line number Diff line number Diff line change
Expand Up @@ -426,6 +426,7 @@ my @disablables = (
"autoload-config",
"bf",
"blake2",
"boring-quic-api",
"brotli",
"brotli-dynamic",
"buildtest-c++",
Expand Down Expand Up @@ -579,6 +580,7 @@ our %disabled = ( # "what" => "comment"
"ktls" => "default",
"md2" => "default",
"msan" => "default",
"quic" => "default",
"rc5" => "default",
"sctp" => "default",
"ssl3" => "default",
Expand Down Expand Up @@ -613,6 +615,7 @@ my @disable_cascades = (
"srtp", "ssl3-method", "ssl-trace",
"tfo",
"ts", "ui-console", "whirlpool",
"boring-quic-api",
"fips-securitychecks" ],
sub { $config{processor} eq "386" }
=> [ "sse2" ],
Expand All @@ -622,7 +625,7 @@ my @disable_cascades = (
"brotli" => [ "brotli-dynamic" ],
"zstd" => [ "zstd-dynamic" ],
"des" => [ "mdc2" ],
"ec" => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost", "ecx" ],
"ec" => [ "ec2m", "ecdsa", "ecdh", "sm2", "gost", "ecx", "boring-quic-api" ],
"dgram" => [ "dtls", "quic", "sctp" ],
"sock" => [ "dgram", "tfo" ],
"dtls" => [ @dtls ],
Expand All @@ -632,7 +635,7 @@ my @disable_cascades = (
"tls" => [ @tls ],
sub { 0 == scalar grep { !$disabled{$_} } @tls }
=> [ "tls" ],
"tls1_3" => [ "quic" ],
"tls1_3" => [ "quic" , "boring-quic-api"],
"quic" => [ "unstable-qlog" ],

"crypto-mdebug" => [ "crypto-mdebug-backtrace" ],
Expand Down Expand Up @@ -675,6 +678,7 @@ my @disable_cascades = (
"legacy" => [ "md2" ],

"cmp" => [ "crmf" ],
"tls1_3" => [ "boring-quic-api" ],

"fips" => [ "fips-securitychecks", "acvp-tests" ],

Expand Down Expand Up @@ -1214,6 +1218,11 @@ if (grep { /-rpath\b/ } ($user{LDFLAGS} ? @{$user{LDFLAGS}} : ())
"***** any of asan, msan or ubsan\n";
}

if (!($disabled{quic} || $disabled{"boring-quic-api"})) {
die "**** boring-quic-api and quic are incompatible options.\n",
"**** If you want to turn on quic explicitly disable boring-quic-api.\n";
}

# If no target was given, try guessing.
unless ($target) {
my %system_config = OpenSSL::config::get_platform(%guess_opts, %user);
Expand Down
4 changes: 4 additions & 0 deletions INSTALL.md
Original file line number Diff line number Diff line change
Expand Up @@ -904,6 +904,10 @@ Don't use POSIX IO capabilities.

Don't build support for Pre-Shared Key based ciphersuites.

### no-quic

Don't build support for QUIC API from BoringSSL.

### no-rdrand

Don't use hardware RDRAND capabilities.
Expand Down
224 changes: 224 additions & 0 deletions README-OpenSSL.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,224 @@
Welcome to the OpenSSL Project
==============================

[![openssl logo]][www.openssl.org]

[![github actions ci badge]][github actions ci]
[![appveyor badge]][appveyor jobs]

OpenSSL is a robust, commercial-grade, full-featured Open Source Toolkit
for the Transport Layer Security (TLS) protocol formerly known as the
Secure Sockets Layer (SSL) protocol. The protocol implementation is based
on a full-strength general purpose cryptographic library, which can also
be used stand-alone.

OpenSSL is descended from the SSLeay library developed by Eric A. Young
and Tim J. Hudson.

The official Home Page of the OpenSSL Project is [www.openssl.org].

Table of Contents
=================

- [Overview](#overview)
- [Download](#download)
- [Build and Install](#build-and-install)
- [Documentation](#documentation)
- [License](#license)
- [Support](#support)
- [Contributing](#contributing)
- [Legalities](#legalities)

Overview
========

The OpenSSL toolkit includes:

- **libssl**
an implementation of all TLS protocol versions up to TLSv1.3 ([RFC 8446]).

- **libcrypto**
a full-strength general purpose cryptographic library. It constitutes the
basis of the TLS implementation, but can also be used independently.

- **openssl**
the OpenSSL command line tool, a swiss army knife for cryptographic tasks,
testing and analyzing. It can be used for
- creation of key parameters
- creation of X.509 certificates, CSRs and CRLs
- calculation of message digests
- encryption and decryption
- SSL/TLS client and server tests
- handling of S/MIME signed or encrypted mail
- and more...

Download
========

For Production Use
------------------

Source code tarballs of the official releases can be downloaded from
[www.openssl.org/source](https://www.openssl.org/source).
The OpenSSL project does not distribute the toolkit in binary form.

However, for a large variety of operating systems precompiled versions
of the OpenSSL toolkit are available. In particular, on Linux and other
Unix operating systems, it is normally recommended to link against the
precompiled shared libraries provided by the distributor or vendor.

For Testing and Development
---------------------------

Although testing and development could in theory also be done using
the source tarballs, having a local copy of the git repository with
the entire project history gives you much more insight into the
code base.

The official OpenSSL Git Repository is located at [git.openssl.org].
There is a GitHub mirror of the repository at [github.com/openssl/openssl],
which is updated automatically from the former on every commit.

A local copy of the Git Repository can be obtained by cloning it from
the original OpenSSL repository using

git clone git://git.openssl.org/openssl.git

or from the GitHub mirror using

git clone https://github.com/openssl/openssl.git

If you intend to contribute to OpenSSL, either to fix bugs or contribute
new features, you need to fork the OpenSSL repository openssl/openssl on
GitHub and clone your public fork instead.

git clone https://github.com/yourname/openssl.git

This is necessary because all development of OpenSSL nowadays is done via
GitHub pull requests. For more details, see [Contributing](#contributing).

Build and Install
=================

After obtaining the Source, have a look at the [INSTALL](INSTALL.md) file for
detailed instructions about building and installing OpenSSL. For some
platforms, the installation instructions are amended by a platform specific
document.

* [Notes for UNIX-like platforms](NOTES-UNIX.md)
* [Notes for Android platforms](NOTES-ANDROID.md)
* [Notes for Windows platforms](NOTES-WINDOWS.md)
* [Notes for the DOS platform with DJGPP](NOTES-DJGPP.md)
* [Notes for the OpenVMS platform](NOTES-VMS.md)
* [Notes on Perl](NOTES-PERL.md)
* [Notes on Valgrind](NOTES-VALGRIND.md)

Specific notes on upgrading to OpenSSL 3.0 from previous versions can be found
in the [migration_guide(7ossl)] manual page.

Documentation
=============

Manual Pages
------------

The manual pages for the master branch and all current stable releases are
available online.

- [OpenSSL master](https://www.openssl.org/docs/manmaster)
- [OpenSSL 3.0](https://www.openssl.org/docs/man3.0)
- [OpenSSL 1.1.1](https://www.openssl.org/docs/man1.1.1)

Wiki
----

There is a Wiki at [wiki.openssl.org] which is currently not very active.
It contains a lot of useful information, not all of which is up-to-date.

License
=======

OpenSSL is licensed under the Apache License 2.0, which means that
you are free to get and use it for commercial and non-commercial
purposes as long as you fulfill its conditions.

See the [LICENSE.txt](LICENSE.txt) file for more details.

Support
=======

There are various ways to get in touch. The correct channel depends on
your requirement. See the [SUPPORT](SUPPORT.md) file for more details.

Contributing
============

If you are interested and willing to contribute to the OpenSSL project,
please take a look at the [CONTRIBUTING](CONTRIBUTING.md) file.

Legalities
==========

A number of nations restrict the use or export of cryptography. If you are
potentially subject to such restrictions, you should seek legal advice before
attempting to develop or distribute cryptographic code.

Copyright
=========

Copyright (c) 1998-2024 The OpenSSL Project

Copyright (c) 1995-1998 Eric A. Young, Tim J. Hudson

All rights reserved.

<!-- Links -->

[www.openssl.org]:
<https://www.openssl.org>
"OpenSSL Homepage"

[git.openssl.org]:
<https://git.openssl.org>
"OpenSSL Git Repository"

[git.openssl.org]:
<https://git.openssl.org>
"OpenSSL Git Repository"

[github.com/openssl/openssl]:
<https://github.com/openssl/openssl>
"OpenSSL GitHub Mirror"

[wiki.openssl.org]:
<https://wiki.openssl.org>
"OpenSSL Wiki"

[migration_guide(7ossl)]:
<https://www.openssl.org/docs/man3.0/man7/migration_guide.html>
"OpenSSL Migration Guide"

[RFC 8446]:
<https://tools.ietf.org/html/rfc8446>

<!-- Logos and Badges -->

[openssl logo]:
doc/images/openssl.svg
"OpenSSL Logo"

[github actions ci badge]:
<https://github.com/openssl/openssl/workflows/GitHub%20CI/badge.svg>
"GitHub Actions CI Status"

[github actions ci]:
<https://github.com/openssl/openssl/actions?query=workflow%3A%22GitHub+CI%22>
"GitHub Actions CI"

[appveyor badge]:
<https://ci.appveyor.com/api/projects/status/8e10o7xfrg73v98f/branch/master?svg=true>
"AppVeyor Build Status"

[appveyor jobs]:
<https://ci.appveyor.com/project/openssl/openssl/branch/master>
"AppVeyor Jobs"
Loading

0 comments on commit 9f3c339

Please sign in to comment.