Skip to content

Bug 5133: OpenSSL 3.0 support #694

Closed
yadij wants to merge 38 commits intosquid-cache:masterfrom
yadij:openssl-3.0
Closed

Bug 5133: OpenSSL 3.0 support #694
yadij wants to merge 38 commits intosquid-cache:masterfrom
yadij:openssl-3.0

Conversation

@yadij
Copy link
Contributor

@yadij yadij commented Jul 23, 2020 •
edited by rousskov
Loading

This TLS update includes:

  • Fix build with OpenSSL v3.
  • Refactor RSA key generation to avoid deprecated RSA_*() APIs.
  • Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
  • Refactor ECDH key creation to avoid deprecated EC_*() APIs.
  • Deprecate ssl_engine support in builds with OpenSSL v1-.
  • Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

  1. We do not have the resources to update ssl_engine code to build
    (without deprecation warnings) with OpenSSL v3 when the feature is
    unused.

  2. We do not have the resources to create an OpenSSL v3 Provider-based
    replacement for ssl_engine code that uses deprecated Engine APIs.

  3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
    in applications that use Engine APIs with OpenSSL v3). Since Squid
    default builds use -Werror, doing nothing would break such builds.

  4. Squid ssl_engine does not appear to be a popular feature.

@yadij yadij changed the title OpenSSL 3.0 support WIP: OpenSSL 3.0 support Jul 23, 2020
@yadij yadij marked this pull request as draft July 23, 2020 18:34
@squid-anubis squid-anubis added M-failed-other https://github.com/measurement-factory/anubis#pull-request-labels and removed M-failed-other https://github.com/measurement-factory/anubis#pull-request-labels labels Aug 8, 2020
@yadij yadij force-pushed the openssl-3.0 branch 2 times, most recently from 2741c11 to fc5d86d Compare August 24, 2020 08:44
@yadij yadij requested a review from chtsanti September 7, 2020 19:38
@yadij
Copy link
Contributor Author

yadij commented Sep 7, 2020

@christos, this EVP change to cert generation seems to work fine for me with libssl1.1. But when I build against libssl3 the first "make check" test of default squid.conf parsing hangs when initializing the default "untrusted" server cert Squid uses for error responses.

Is there anything you can see I'm doing wrong or can think of elsewhere that may be leading to the hang?

Does this code work for you with OpenSSL 1.1 ?
i.e. is it good enough to merge the RSA upgrade for older OpenSSL and treat as a bug in v3.0?

If we cant track this down ourselves I will try to get in touch with OpenSSL dev about a possible v3 bug at their end.

chtsanti
chtsanti reviewed Sep 10, 2020
View reviewed changes
@chtsanti
Copy link
Contributor

chtsanti commented Sep 10, 2020

@christos, this EVP change to cert generation seems to work fine for me with libssl1.1. But when I build against libssl3 the first "make check" test of default squid.conf parsing hangs when initializing the default "untrusted" server cert Squid uses for error responses.

The "make check" works for me using openSSL-1.1.1 and openSSL-3.0.0alpha5 releases.

Is there anything you can see I'm doing wrong or can think of elsewhere that may be leading to the hang?

My sense is that the CreateRsaPrivateKey is not correctly implemented. But I do not know if it can hang squid.

Does this code work for you with OpenSSL 1.1 ?
i.e. is it good enough to merge the RSA upgrade for older OpenSSL and treat as a bug in v3.0?

If we cant track this down ourselves I will try to get in touch with OpenSSL dev about a possible v3 bug at their end.

I must also note that when squid trying to use an openSSL-3.0.0 which is not compiled with OPENSSL_NO_ENGINE flag can not compile. It will fail inside Ssl::Initialize, support.cc file inside OPENSSL_NO_ENGINE related block of code

@squid-anubis squid-anubis added M-failed-other https://github.com/measurement-factory/anubis#pull-request-labels and removed M-failed-other https://github.com/measurement-factory/anubis#pull-request-labels labels Dec 23, 2020
@squid-anubis squid-anubis added M-failed-other https://github.com/measurement-factory/anubis#pull-request-labels and removed M-failed-other https://github.com/measurement-factory/anubis#pull-request-labels labels Jan 8, 2021
@yadij yadij removed the S-waiting-for-author author action is expected (and usually required) label Jul 16, 2022
@yadij
Copy link
Contributor Author

yadij commented Jul 16, 2022

As of d4a42e7 all the requests that have been insisted on are resolved.

There is just #694 (comment) which I leave to @rousskov to submit a PR making the change. Since that is not being insisted on include AFAICT this PR is ready to go in.

@yadij yadij added the S-waiting-for-committer privileged action is expected (and usually required) label Jul 16, 2022
@rousskov rousskov dismissed their stale review July 16, 2022 15:01

Thank you for addressing all blocking concerns.

@rousskov rousskov removed their request for review July 16, 2022 15:01
@rousskov rousskov added the M-cleared-for-merge https://github.com/measurement-factory/anubis#pull-request-labels label Jul 16, 2022
@rousskov
Copy link
Contributor

rousskov commented Jul 16, 2022

AFAICT this PR is ready to go in.

I have no objections and have cleared this PR for merging.

@yadij yadij requested a review from chtsanti 9 months ago
@yadij yadij requested review from hno 27 days ago

However, I will not dismiss @yadij review requests to avoid creating a dangerous precedent. @yadij, please cancel those requests if you believe those reviews are no longer required. Anubis will not merge while those review requests are pending.

@yadij yadij removed request for chtsanti and hno July 17, 2022 13:06
@squid-anubis squid-anubis added the M-waiting-staging-checks https://github.com/measurement-factory/anubis#pull-request-labels label Jul 17, 2022
squid-anubis pushed a commit that referenced this pull request Jul 17, 2022
@yadij @squid-anubis
Bug 5133: OpenSSL 3.0 support (#694)
742236c 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
@yadij yadij removed S-waiting-for-reviewer ready for review: Set this when requesting a (re)review using GitHub PR Reviewers box S-waiting-for-committer privileged action is expected (and usually required) labels Jul 17, 2022
@squid-anubis squid-anubis added M-merged https://github.com/measurement-factory/anubis#pull-request-labels and removed M-waiting-staging-checks https://github.com/measurement-factory/anubis#pull-request-labels M-cleared-for-merge https://github.com/measurement-factory/anubis#pull-request-labels labels Jul 17, 2022
@rousskov rousskov removed the review-1 label Jul 18, 2022
squidadm pushed a commit to squidadm/squid that referenced this pull request Aug 19, 2022
@yadij @squidadm
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
7e9e204 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
squidadm pushed a commit to squidadm/squid that referenced this pull request Aug 20, 2022
@yadij @squidadm
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
6d4f964 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
squidadm pushed a commit to squidadm/squid that referenced this pull request Aug 20, 2022
@yadij @squidadm
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
da7a55e 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
squidadm pushed a commit to squidadm/squid that referenced this pull request Aug 21, 2022
@yadij @squidadm
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
b12dd41 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
squidadm pushed a commit to squidadm/squid that referenced this pull request Aug 23, 2022
@yadij @squidadm
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
32eb83e 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
yadij added a commit that referenced this pull request Aug 23, 2022
@yadij
Bug 5133: OpenSSL 3.0 support (#694)
3db8afa 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
@wohlford
Copy link

wohlford commented Sep 5, 2022

Squid 5.7 (05 Sep 2022) officially contains support for OpenSSL 3.0.

@NickCao NickCao mentioned this pull request Oct 19, 2022
Merged
13 tasks
kinkie pushed a commit to kinkie/squid that referenced this pull request Dec 28, 2022
@yadij @kinkie
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
7d82c2c 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
@yadij yadij deleted the openssl-3.0 branch February 3, 2023 07:17
kinkie pushed a commit to kinkie/squid that referenced this pull request Jul 2, 2023
@yadij @kinkie
Bug 5133: OpenSSL 3.0 support (squid-cache#694)
e103326 
This TLS update includes:

* Fix build with OpenSSL v3.
* Refactor RSA key generation to avoid deprecated RSA_*() APIs.
* Refactor DH parameter and key config to avoid deprecated DH_*() APIs.
* Refactor ECDH key creation to avoid deprecated EC_*() APIs.
* Deprecate ssl_engine support in builds with OpenSSL v1-.
* Disable ssl_engine support in builds OpenSSL v3+.

We deprecated/removed ssl_engine support (as summarized in the last two
bullets above) without providing an OpenSSL Providers-based alternative
because of the following factors:

1. We do not have the resources to update ssl_engine code to build
   (without deprecation warnings) with OpenSSL v3 when the feature is
   unused.

2. We do not have the resources to create an OpenSSL v3 Provider-based
   replacement for ssl_engine code that uses deprecated Engine APIs.

3. OpenSSL v3 deprecated Engine support (triggering deprecation warnings
   in applications that use Engine APIs with OpenSSL v3). Since Squid
   default builds use -Werror, doing nothing would break such builds.

4. Squid ssl_engine does not appear to be a popular feature.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hno hno hno left review comments

@kinkie kinkie kinkie left review comments

@chtsanti chtsanti chtsanti left review comments

@rousskov rousskov rousskov left review comments

Assignees

No one assigned

Labels

feature maintainer needs documentation updates for merge M-merged https://github.com/measurement-factory/anubis#pull-request-labels

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

9 participants

@yadij @chtsanti @satya-rajesh @sergiodj @rousskov @kinkie @wohlford @hno @squid-anubis