Add support for OpenSSL

Cargo.toml

@@ -9,6 +9,7 @@ default = ["tls-ring"]
 jemalloc = ["dep:tikv-jemallocator", "dep:jemalloc_pprof"]
 tls-boring = ["dep:boring", "dep:boring-sys", "boring-rustls-provider/fips-only"]
 tls-ring = ["dep:ring", "rustls/ring", "tokio-rustls/ring", "hyper-rustls/ring", "dep:rcgen"]
+tls-openssl = ["dep:rustls-openssl", "dep:openssl" ]
 testing = ["dep:rcgen", "rcgen/x509-parser"] # Enables utilities supporting tests.
 
 [lib]
@@ -37,6 +38,10 @@ boring-sys = { version = "4", optional = true }
 # Enabled with 'tls-ring'
 ring = { version = "0.17", optional = true }
 
+# Enabled with 'tls-openssl'
+rustls-openssl = { version = "0.2", optional = true }
+openssl = { version = "0.10", optional = true }
+
 anyhow = "1.0"
 async-stream = "0.3"
 async-trait = "0.1"

Makefile.core.mk

@@ -3,6 +3,8 @@ include common/Makefile.common.mk
 FEATURES ?=
 ifeq ($(TLS_MODE), boring)
 	FEATURES:=--no-default-features -F tls-boring
+else ifeq ($(TLS_MODE), openssl)
+	FEATURES:=--no-default-features -F tls-openssl
 endif
 
 test:
@@ -21,6 +23,7 @@ inpodserver:
 # Test that all important features build
 check-features:
 	cargo check --no-default-features -F tls-boring
+	cargo check --no-default-features -F tls-openssl
 	cargo check -F jemalloc
 	(cd fuzz; RUSTFLAGS="--cfg fuzzing" cargo check)
 

README.md

@@ -34,10 +34,11 @@ Ztunnel's TLS is built on [rustls](https://github.com/rustls/rustls).
 
 Rustls has support for plugging in various crypto providers to meet various needs (compliance, performance, etc).
 
-| Name                                          | How To Enable                                  |
-|-----------------------------------------------|------------------------------------------------|
-| [ring](https://github.com/briansmith/ring/)   | Default (or `--features tls-ring`)             |
-| [boring](https://github.com/cloudflare/boring) | `--features tls-boring --no-default-features` |
+| Name                                               | How To Enable                                  |
+|----------------------------------------------------|------------------------------------------------|
+| [ring](https://github.com/briansmith/ring/)        | Default (or `--features tls-ring`)             |
+| [boring](https://github.com/cloudflare/boring)     | `--features tls-boring --no-default-features`  |
+| [openssl](https://github.com/tofay/rustls-openssl) | `--features tls-openssl --no-default-features` |
 
 In all options, only TLS 1.3 with cipher suites `TLS13_AES_256_GCM_SHA384` and `TLS13_AES_128_GCM_SHA256` is used.
 

deny.toml

@@ -4,7 +4,7 @@ targets = [
     { triple = "x86_64-unknown-linux-gnu" },
     { triple = "aarch64-unknown-linux-gnu" },
 ]
-features = ["tls-boring", "tls-ring"]
+features = ["tls-boring", "tls-ring", "tls-openssl" ]
 
 [advisories]
 version = 2

scripts/release.sh

@@ -31,6 +31,8 @@ if [[ "$TLS_MODE" == "boring" ]]; then
     sed -i 's/x86_64/arm64/g' .cargo/config.toml
   fi
   cargo build --release --no-default-features -F tls-boring
+elif [[ "$TLS_MODE" == "openssl" ]]; then
+  cargo build --release --no-default-features -F tls-openssl
 else
   cargo build --release
 fi

src/tls.rs

@@ -53,6 +53,10 @@ pub enum Error {
     #[cfg(feature = "tls-boring")]
     SslError(#[from] boring::error::ErrorStack),
 
+    #[error("invalid operation: {0:?}")]
+    #[cfg(feature = "tls-openssl")]
+    SslError(#[from] openssl::error::ErrorStack),
+
     #[error("invalid certificate generation: {0:?}")]
     #[cfg(feature = "tls-ring")]
     RcgenError(Arc<rcgen::Error>),

src/tls/csr.rs

@@ -80,6 +80,45 @@ impl CsrOptions {
             private_key: private_key.into(),
         })
     }
+
+    #[cfg(feature = "tls-openssl")]
+    pub fn generate(&self) -> Result<CertSign, Error> {
+        use openssl::ec::{EcGroup, EcKey};
+        use openssl::hash::MessageDigest;
+        use openssl::nid::Nid;
+        use openssl::pkey::PKey;
+        use openssl::stack::Stack;
+        use openssl::x509::extension::SubjectAlternativeName;
+        use openssl::x509::{self};
+        // TODO: https://github.com/rustls/rcgen/issues/228 can we always use rcgen?
+
+        let group = EcGroup::from_curve_name(Nid::X9_62_PRIME256V1)?;
+        let ec_key = EcKey::generate(&group)?;
+        let pkey = PKey::from_ec_key(ec_key)?;
+
+        let mut csr = x509::X509ReqBuilder::new()?;
+        csr.set_pubkey(&pkey)?;
+        let mut extensions = Stack::new()?;
+        let subject_alternative_name = SubjectAlternativeName::new()
+            .uri(&self.san)
+            .critical()
+            .build(&csr.x509v3_context(None))?;
+
+        extensions.push(subject_alternative_name)?;
+        csr.add_extensions(&extensions)?;
+        csr.sign(&pkey, MessageDigest::sha256())?;
+
+        let csr = csr.build();
+        let pkey_pem = pkey.private_key_to_pem_pkcs8()?;
+        let csr_pem = csr.to_pem()?;
+        let csr_pem = std::str::from_utf8(&csr_pem)
+            .expect("CSR is valid string")
+            .to_string();
+        Ok(CertSign {
+            csr: csr_pem,
+            private_key: pkey_pem,
+        })
+    }
 }
 
 #[cfg(test)]

src/tls/lib.rs

@@ -66,6 +66,18 @@ pub(super) fn provider() -> Arc<CryptoProvider> {
     })
 }
 
+#[cfg(feature = "tls-openssl")]
+pub(super) fn provider() -> Arc<CryptoProvider> {
+    Arc::new(CryptoProvider {
+        // Limit to only the subset of ciphers that are FIPS compatible
+        cipher_suites: vec![
+            rustls_openssl::cipher_suite::TLS13_AES_256_GCM_SHA384,
+            rustls_openssl::cipher_suite::TLS13_AES_128_GCM_SHA256,
+        ],
+        ..rustls_openssl::default_provider()
+    })
+}
+
 #[derive(thiserror::Error, Debug)]
 pub enum TlsError {
     #[error("tls handshake error: {0:?}")]