You are viewing a plain text version of this content. The canonical link for it is here.
Posted to github@trafficserver.apache.org by "JosiahWI (via GitHub)" <gi...@apache.org> on 2026/06/29 19:35:47 UTC
[PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
JosiahWI opened a new pull request, #13349:
URL: https://github.com/apache/trafficserver/pull/13349
This is work for #13347. It does not remove the OpenSSL 1.1.1 compatibility, but it switches the implementation to use OpenSSL 3.x APIs when available.
The change is split into three commits. The first one is a suite of unit tests generated by Claude Opus, which have at least one bug (stripping const from a const-object such as a string literal is highly dangerous; shame on you Claude Opus) and require at least OpenSSL 3.0. I'm happy with the test cases, but I need to fix the issues before taking this out of draft.
The second commit is the OpenSSL 3.0 implementation. This is the easiest place to view the meat of the change without distraction.
Finally, I split most of the work here into a new file called SSLKeyUtils.cc in the third commit. SSLUtils.cc needs refactoring according to CodeScene (the file is massive and not cohesive), and I saw an opportunity to make a small chip in it here in that direction, with the special benefit of isolating all the messy precompiler directives in the new file so that the SSLUtils.cc function remains sleek and build-configuration-independent.
When reviewing, please take a look at `EVP_PKEY_CTX_set_dh_rfc5114`. In the OpenSSL 3 implementation of `gen_dh_2048_258` I would rather use that helper function than manually set params. When I tried it, OpenSSL happily failed the corresponding unit test. Closer docs inspection reveals that the key type has to be `EVP_PK_DHX`, even for the `dh` version of the function. I don't know the difference between DH and DHX and whether it would be behavior-preserving to switch, so I'm asking for help here.
I have been thorough in error-checking and memory management, referring to OpenSSL's API documentation, but I am not familiar with OpenSSL APIs yet. I would appreciate a review from someone with a lot of OpenSSL experience.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on code in PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#discussion_r3494262540
##########
src/iocore/net/SSLKeyUtils.cc:
##########
@@ -0,0 +1,186 @@
+/** @file
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "SSLKeyUtils.h"
+#include "P_SSLUtils.h"
+
+#include <tscore/Diags.h>
+#ifdef OPENSSL_IS_OPENSSL3
+#include <tscore/ink_assert.h>
+#else
+#include <tscore/ink_config.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+#include <openssl/evp.h>
+#include <openssl/decoder.h>
+#include <openssl/params.h>
+#include <openssl/ssl.h>
+#else
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+
+EVP_PKEY *
+gen_dh_2048_256_pkey()
+{
+ scoped_PKEY_CTX pctx{EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL)};
+ if (!pctx) {
+ Error("failed to create OpenSSL pkey context");
+ return nullptr;
+ }
+
+ if (EVP_PKEY_keygen_init(pctx.get()) <= 0) {
+ Error("failed to initialize OpenSSL keygen");
+ return nullptr;
+ }
+
+ char prime_group[]{"dh_2048_256"};
+ OSSL_PARAM const params[]{OSSL_PARAM_utf8_string("group", prime_group, sizeof(prime_group) - 1), OSSL_PARAM_END};
+
+ if (!EVP_PKEY_CTX_set_params(pctx.get(), params)) {
+ Error("SSL dhparams source returned invalid parameters");
+ return nullptr;
+ }
+
+ EVP_PKEY *pkey{};
+ EVP_PKEY_generate(pctx.get(), &pkey);
+
+ return pkey;
+}
+
+EVP_PKEY *
+load_dhparams_file(char const *dhparams_file)
+{
+ EVP_PKEY *pkey{};
+ scoped_Decoder_CTX dctx{OSSL_DECODER_CTX_new_for_pkey(&pkey, "PEM", NULL, "DH", OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, NULL, NULL)};
+ if (!dctx) {
+ Error("failed to create OpenSSL decoder context");
+ return nullptr;
+ }
+
+ ink_assert(OSSL_DECODER_CTX_get_num_decoders(dctx.get()) > 0);
+ scoped_BIO bio{BIO_new_file(dhparams_file, "r")};
+ if (!OSSL_DECODER_from_bio(dctx.get(), bio.get())) {
+ Error("SSL dhparams source returned invalid parameters");
+ return nullptr;
+ }
+
+ return pkey;
+}
+
+bool
+set_ctx_dh(SSL_CTX *ctx, dh_key_t *pkey)
+{
+ bool result{SSL_CTX_set_options(ctx, SSL_OP_SINGLE_DH_USE) && SSL_CTX_set0_tmp_dh_pkey(ctx, pkey)};
+ if (!result) {
+ EVP_PKEY_free(pkey);
+ }
+ return result;
+}
Review Comment:
Of special note: the OpenSSL 3.0 API takes ownership of the key, whereas the older API does not. Therefore, the control flow with respect to memory management is different between the two `set_ctx_dh` implementations, which could be surprising.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#issuecomment-5049843695
[approve ci autest 3]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on code in PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#discussion_r3632114049
##########
src/iocore/net/SSLKeyUtils.cc:
##########
@@ -0,0 +1,186 @@
+/** @file
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "SSLKeyUtils.h"
+#include "P_SSLUtils.h"
+
+#include <tscore/Diags.h>
+#ifdef OPENSSL_IS_OPENSSL3
+#include <tscore/ink_assert.h>
+#else
+#include <tscore/ink_config.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+#include <openssl/evp.h>
+#include <openssl/decoder.h>
+#include <openssl/params.h>
+#include <openssl/ssl.h>
+#else
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+
+EVP_PKEY *
+gen_dh_2048_256_pkey()
+{
+ scoped_PKEY_CTX pctx{EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL)};
+ if (!pctx) {
+ Error("failed to create OpenSSL pkey context");
+ return nullptr;
+ }
+
+ if (EVP_PKEY_keygen_init(pctx.get()) <= 0) {
+ Error("failed to initialize OpenSSL keygen");
+ return nullptr;
+ }
+
+ char prime_group[]{"dh_2048_256"};
+ OSSL_PARAM const params[]{OSSL_PARAM_utf8_string("group", prime_group, 0), OSSL_PARAM_END};
+
+ if (!EVP_PKEY_CTX_set_params(pctx.get(), params)) {
+ Error("SSL dhparams source returned invalid parameters");
+ return nullptr;
+ }
+
+ EVP_PKEY *pkey{};
+ EVP_PKEY_generate(pctx.get(), &pkey);
+
+ return pkey;
Review Comment:
I think this is nonsense.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#discussion_r3536958264
##########
src/iocore/net/SSLKeyUtils.cc:
##########
@@ -0,0 +1,186 @@
+/** @file
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "SSLKeyUtils.h"
+#include "P_SSLUtils.h"
+
+#include <tscore/Diags.h>
+#ifdef OPENSSL_IS_OPENSSL3
+#include <tscore/ink_assert.h>
+#else
+#include <tscore/ink_config.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+#include <openssl/evp.h>
+#include <openssl/decoder.h>
+#include <openssl/params.h>
+#include <openssl/ssl.h>
+#else
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+
+EVP_PKEY *
+gen_dh_2048_256_pkey()
+{
+ scoped_PKEY_CTX pctx{EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL)};
+ if (!pctx) {
+ Error("failed to create OpenSSL pkey context");
+ return nullptr;
+ }
+
+ if (EVP_PKEY_keygen_init(pctx.get()) <= 0) {
+ Error("failed to initialize OpenSSL keygen");
+ return nullptr;
+ }
+
+ char prime_group[]{"dh_2048_256"};
+ OSSL_PARAM const params[]{OSSL_PARAM_utf8_string("group", prime_group, 0), OSSL_PARAM_END};
+
+ if (!EVP_PKEY_CTX_set_params(pctx.get(), params)) {
+ Error("SSL dhparams source returned invalid parameters");
+ return nullptr;
+ }
+
+ EVP_PKEY *pkey{};
+ EVP_PKEY_generate(pctx.get(), &pkey);
+
+ return pkey;
Review Comment:
In the OpenSSL 3 path, this helper initializes the context with EVP_PKEY_keygen_init() but then only needs DH *parameters* for SSL_CTX_set0_tmp_dh_pkey(). Using keygen here is unnecessary work (generates private key material) and can consume extra entropy; also EVP_PKEY_generate()’s return value is not checked, so failures silently return a null/partial key.
##########
src/iocore/net/SSLKeyUtils.cc:
##########
@@ -0,0 +1,186 @@
+/** @file
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "SSLKeyUtils.h"
+#include "P_SSLUtils.h"
+
+#include <tscore/Diags.h>
+#ifdef OPENSSL_IS_OPENSSL3
+#include <tscore/ink_assert.h>
+#else
+#include <tscore/ink_config.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+#include <openssl/evp.h>
+#include <openssl/decoder.h>
+#include <openssl/params.h>
+#include <openssl/ssl.h>
+#else
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+
+EVP_PKEY *
+gen_dh_2048_256_pkey()
+{
+ scoped_PKEY_CTX pctx{EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL)};
+ if (!pctx) {
+ Error("failed to create OpenSSL pkey context");
+ return nullptr;
+ }
+
+ if (EVP_PKEY_keygen_init(pctx.get()) <= 0) {
+ Error("failed to initialize OpenSSL keygen");
+ return nullptr;
+ }
+
+ char prime_group[]{"dh_2048_256"};
+ OSSL_PARAM const params[]{OSSL_PARAM_utf8_string("group", prime_group, 0), OSSL_PARAM_END};
+
+ if (!EVP_PKEY_CTX_set_params(pctx.get(), params)) {
+ Error("SSL dhparams source returned invalid parameters");
+ return nullptr;
+ }
+
+ EVP_PKEY *pkey{};
+ EVP_PKEY_generate(pctx.get(), &pkey);
+
+ return pkey;
+}
+
+EVP_PKEY *
+load_dhparams_file(char const *dhparams_file)
+{
+ EVP_PKEY *pkey{};
+ scoped_Decoder_CTX dctx{OSSL_DECODER_CTX_new_for_pkey(&pkey, "PEM", NULL, "DH", OSSL_KEYMGMT_SELECT_ALL_PARAMETERS, NULL, NULL)};
+ if (!dctx) {
+ Error("failed to create OpenSSL decoder context");
+ return nullptr;
+ }
+
+ ink_assert(OSSL_DECODER_CTX_get_num_decoders(dctx.get()) > 0);
+ scoped_BIO bio{BIO_new_file(dhparams_file, "r")};
+ if (!OSSL_DECODER_from_bio(dctx.get(), bio.get())) {
+ Error("SSL dhparams source returned invalid parameters");
+ return nullptr;
+ }
+
+ return pkey;
+}
Review Comment:
load_dhparams_file() assumes BIO_new_file() succeeds and passes bio.get() to OSSL_DECODER_from_bio() unconditionally. If the file can’t be opened (e.g., nonexistent path), bio will be null and this can crash. Also, using ink_assert() on decoder availability turns a missing/disabled decoder/provider into a hard abort instead of a clean configuration error.
##########
src/iocore/net/unit_tests/test_SSLDHParams.cc:
##########
@@ -0,0 +1,186 @@
+/** @file
+
+ Catch based unit tests for the DH-parameter handling behavior of
+ SSLMultiCertConfigLoader::init_server_ssl_ctx, which is the inknet
+ public boundary that transitively invokes ssl_context_enable_dhe
+ and (when a file is configured) load_dhparams_file.
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include <iocore/net/SSLMultiCertConfigLoader.h>
+#include "../P_SSLCertLookup.h"
+#include "../P_SSLConfig.h"
+#include "../P_SSLUtils.h"
+
+#include <tscore/ink_memory.h>
+#include <tscore/ink_platform.h>
+
+#include <catch2/catch_test_macros.hpp>
+
+#include <openssl/bio.h>
+#include <openssl/core_names.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+
+#include <cstdio>
+#include <string>
+
+namespace
+{
+
+std::string
+make_valid_dh_pem()
+{
+ EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(nullptr, "DH", nullptr);
+ REQUIRE(pctx != nullptr);
+ REQUIRE(EVP_PKEY_paramgen_init(pctx) > 0);
+ char prime_group[]{"dh_2048_256"};
+ OSSL_PARAM const params[2] = {
+ OSSL_PARAM_construct_utf8_string("group", prime_group, 0),
+ OSSL_PARAM_construct_end(),
+ };
+ REQUIRE(EVP_PKEY_CTX_set_params(pctx, params) > 0);
+ EVP_PKEY *pkey = nullptr;
+ REQUIRE(EVP_PKEY_generate(pctx, &pkey) > 0);
+
+ BIO *bio = BIO_new(BIO_s_mem());
+ REQUIRE(PEM_write_bio_Parameters(bio, pkey) == 1);
+ BUF_MEM *bm = nullptr;
+ BIO_get_mem_ptr(bio, &bm);
+ std::string out{bm->data, bm->length};
+ BIO_free(bio);
+ EVP_PKEY_free(pkey);
+ EVP_PKEY_CTX_free(pctx);
+ return out;
+}
+
+std::string
+make_rsa_pem()
+{
+ EVP_PKEY *pkey = EVP_RSA_gen(1024);
Review Comment:
This test generates a 1024-bit RSA key to produce a “wrong key type” PEM. 1024-bit RSA is rejected in some OpenSSL 3 configurations/policies (notably FIPS), which can make the unit test fail for reasons unrelated to DH parameter handling. Using 2048 avoids that class of policy failures while still exercising the DH-only decoder rejection path.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on code in PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#discussion_r3494251495
##########
src/iocore/net/SSLKeyUtils.cc:
##########
@@ -0,0 +1,186 @@
+/** @file
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include "SSLKeyUtils.h"
+#include "P_SSLUtils.h"
+
+#include <tscore/Diags.h>
+#ifdef OPENSSL_IS_OPENSSL3
+#include <tscore/ink_assert.h>
+#else
+#include <tscore/ink_config.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+#include <openssl/evp.h>
+#include <openssl/decoder.h>
+#include <openssl/params.h>
+#include <openssl/ssl.h>
+#else
+#include <openssl/bio.h>
+#include <openssl/bn.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+#endif
+
+#ifdef OPENSSL_IS_OPENSSL3
+
+EVP_PKEY *
+gen_dh_2048_256_pkey()
+{
+ scoped_PKEY_CTX pctx{EVP_PKEY_CTX_new_from_name(NULL, "DH", NULL)};
+ if (!pctx) {
+ Error("failed to create OpenSSL pkey context");
+ return nullptr;
+ }
+
+ if (EVP_PKEY_keygen_init(pctx.get()) <= 0) {
+ Error("failed to initialize OpenSSL keygen");
+ return nullptr;
+ }
+
+ char prime_group[]{"dh_2048_256"};
+ OSSL_PARAM const params[]{OSSL_PARAM_utf8_string("group", prime_group, sizeof(prime_group) - 1), OSSL_PARAM_END};
+
+ if (!EVP_PKEY_CTX_set_params(pctx.get(), params)) {
Review Comment:
This is where I want to use the `EVP_PKEY_CTX_set_dh_rfc5114` function instead of manually setting parameters.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#issuecomment-5049660294
[approve ci autest 3[
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#issuecomment-4904290751
[approve ci debian]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI merged PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "cmcfarlen (via GitHub)" <gi...@apache.org>.
cmcfarlen commented on PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#issuecomment-5144754866
Cherry-picked to the 10.2.x branch as a8329a928257e3685e1ca61264b19670775c000a for the 10.2.0 release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Support OpenSSL 3.0 APIs for Diffie-Hellman [trafficserver]
Posted by "JosiahWI (via GitHub)" <gi...@apache.org>.
JosiahWI commented on code in PR #13349:
URL: https://github.com/apache/trafficserver/pull/13349#discussion_r3494264984
##########
src/iocore/net/unit_tests/test_SSLDHParams.cc:
##########
@@ -0,0 +1,183 @@
+/** @file
+
+ Catch based unit tests for the DH-parameter handling behavior of
+ SSLMultiCertConfigLoader::init_server_ssl_ctx, which is the inknet
+ public boundary that transitively invokes ssl_context_enable_dhe
+ and (when a file is configured) load_dhparams_file.
+
+ @section license License
+
+ Licensed to the Apache Software Foundation (ASF) under one
+ or more contributor license agreements. See the NOTICE file
+ distributed with this work for additional information
+ regarding copyright ownership. The ASF licenses this file
+ to you under the Apache License, Version 2.0 (the
+ "License"); you may not use this file except in compliance
+ with the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+ */
+
+#include <iocore/net/SSLMultiCertConfigLoader.h>
+#include "../P_SSLCertLookup.h"
+#include "../P_SSLConfig.h"
+#include "../P_SSLUtils.h"
+
+#include <tscore/ink_memory.h>
+#include <tscore/ink_platform.h>
+
+#include <catch2/catch_test_macros.hpp>
+
+#include <openssl/bio.h>
+#include <openssl/core_names.h>
+#include <openssl/evp.h>
+#include <openssl/pem.h>
+#include <openssl/ssl.h>
+
+#include <cstdio>
+#include <string>
+
+namespace
+{
+
+std::string
+make_valid_dh_pem()
+{
+ EVP_PKEY_CTX *pctx = EVP_PKEY_CTX_new_from_name(nullptr, "DH", nullptr);
+ REQUIRE(pctx != nullptr);
+ REQUIRE(EVP_PKEY_paramgen_init(pctx) > 0);
+ OSSL_PARAM params[2] = {
+ OSSL_PARAM_construct_utf8_string("group", const_cast<char *>("ffdhe2048"), 0),
Review Comment:
Segfault waiting to happen.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: github-unsubscribe@trafficserver.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org