Build against openssl-sys low-level bindings

Linking applications against different bindings to the same library
(openssl) is undefined behavior in rust ecosystem.

This is removing the low-level bindings and bindgen dependency,
delefating this to the openssl-sys crate providing all the low-level
functions.

Unfortunately, it does not expose all the constants and defines,
that need to be defined manually.

The direct static linking to libfips is preserved.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

Author: Jakuje

.github/workflows/rpm.yml

@@ -56,7 +56,7 @@ jobs:
                 'crate(num-integer/default)' 'crate(num-traits/default)' \
                 'crate(pkg-config/default)' 'crate(rusqlite/default)' \
                 'crate(serde/default)' 'crate(serde/derive)' 'crate(serde_json/default)' \
-                'crate(serial_test/default)' \
+                'crate(serial_test/default)' 'crate(itertools/default)' 'crate(openssl-sys/bindgen)' \
                 'crate(toml)' 'crate(toml/display)' 'crate(toml/parse)' 'crate(toml/serde)' \
                 'crate(uuid/default)' 'crate(uuid/v4)' 'crate(uuid/v8)' 'crate(cryptoki/default)' \
                 'crate(vsprintf/default)' 'crate(quick-xml/default)' 'crate(quick-xml/serialize)'

ossl/Cargo.toml

@@ -1,6 +1,5 @@
 [package]
 name = "ossl"
-links = "openssl"
 version.workspace = true
 edition.workspace = true
 description = "OpenSSL version 3+ bindings to modern EVP APIs"
@@ -12,6 +11,7 @@ license = "Apache-2.0"
 test = true
 
 [build-dependencies]
+# this is technically optional, but we either use it directly or through openssl-sys
 bindgen = "0.72"
 pkg-config = "0.3"
 
@@ -20,6 +20,7 @@ cfg-if = "1.0.0"
 libc = "0.2.151"
 log = { version = "0.4.27", default-features = false, features = ["std"], optional = true }
 vsprintf = { version = "2.0.0", optional = true }
+openssl-sys = { version = "0.9", features = ["bindgen"], optional = true }
 
 [dev-dependencies]
 hex = "0.4.3"
@@ -29,7 +30,7 @@ serial_test = "3.1.1"
 ossl320 = [] # Requires at a minimum OpenSSL 3.2.0
 ossl350 = [] # Requires at a minimum OpenSSL 3.5.0
 ossl400 = [] # Requires at minimum OpenSSL 4.0
-dynamic = [] # Builds against system libcrypto.so
+dynamic = ["dep:openssl-sys"] # Builds against system libcrypto.so
 fips = ["ossl350"] # Builds against sources and libfips.a instead of libcrypto
 log = ["dep:log", "dep:vsprintf"] # Error tracing using log crate
 rfc9580 = [] # Enables features required for OpenPGP implementations

ossl/build.rs

@@ -3,6 +3,7 @@
 
 use std::env;
 use std::panic::set_hook;
+#[cfg(not(feature = "dynamic"))]
 use std::path::{Path, PathBuf};
 
 #[derive(Debug)]
@@ -12,68 +13,63 @@ const OPENSSL_3_2_0: i64 = 0x30200000;
 const OPENSSL_3_5_0: i64 = 0x30500000;
 const OPENSSL_4_0_0: i64 = 0x40000000;
 
+fn check_ossl_version(version: i64) {
+    if version < OPENSSL_4_0_0 {
+        #[cfg(feature = "ossl400")]
+        panic!("OpenSSL 4.0.0 or later is required");
+    }
+    if version < OPENSSL_3_5_0 {
+        #[cfg(feature = "ossl350")]
+        panic!("OpenSSL 3.5.0 or later is required");
+    }
+    if version < OPENSSL_3_2_0 {
+        #[cfg(feature = "ossl320")]
+        panic!("OpenSSL 3.2.0 or later is required");
+    }
+    if version < OPENSSL_3_0_7 {
+        panic!(
+            "OpenSSL 3.0.7 is the minimum viable version. Found {:x}",
+            version
+        );
+    }
+    /* Emit versions we found, versions stack, so code
+     * just need to build conditionalized just to the older version
+     * that introduced the desired feature */
+    println!("cargo::rustc-cfg=ossl_v307");
+    if version >= OPENSSL_3_2_0 {
+        println!("cargo::rustc-cfg=ossl_v320");
+    }
+    if version >= OPENSSL_3_5_0 {
+        println!("cargo::rustc-cfg=ossl_v350");
+    }
+    if version >= OPENSSL_4_0_0 {
+        println!("cargo::rustc-cfg=ossl_v400");
+    }
+}
+
+#[cfg(not(feature = "dynamic"))]
 impl bindgen::callbacks::ParseCallbacks for OsslCallbacks {
     fn int_macro(
         &self,
         name: &str,
         value: i64,
     ) -> Option<bindgen::callbacks::IntKind> {
         if name == "OPENSSL_VERSION_NUMBER" {
-            if value < OPENSSL_4_0_0 {
-                #[cfg(feature = "ossl400")]
-                panic!("OpenSSL 4.0.0 or later is required");
-            }
-            if value < OPENSSL_3_5_0 {
-                #[cfg(feature = "ossl350")]
-                panic!("OpenSSL 3.5.0 or later is required");
-            }
-            if value < OPENSSL_3_2_0 {
-                #[cfg(feature = "ossl320")]
-                panic!("OpenSSL 3.2.0 or later is required");
-            }
-            if value < OPENSSL_3_0_7 {
-                panic!(
-                    "OpenSSL 3.0.7 is the minimum viable version. Found {:x}",
-                    value
-                );
-            }
-            /* Emit versions we found, versions stack, so code
-             * just need to build conditionalized just to the older version
-             * that introduced the desired feature */
-            println!("cargo::rustc-cfg=ossl_v307");
-            if value >= OPENSSL_3_2_0 {
-                println!("cargo::rustc-cfg=ossl_v320");
-            }
-            if value >= OPENSSL_3_5_0 {
-                println!("cargo::rustc-cfg=ossl_v350");
-            }
-            if value >= OPENSSL_4_0_0 {
-                println!("cargo::rustc-cfg=ossl_v400");
-            }
+            check_ossl_version(value);
         }
 
         None
     }
 
-    fn str_macro(&self, name: &str, _value: &[u8]) {
-        if name == "OSSL_PKEY_PARAM_SLH_DSA_SEED" {
-            println!("cargo::rustc-cfg=ossl_slhdsa")
-        }
-        if name == "OSSL_PKEY_PARAM_ML_DSA_SEED" {
-            println!("cargo::rustc-cfg=ossl_mldsa")
-        }
-        if name == "OSSL_PKEY_PARAM_ML_KEM_SEED" {
-            println!("cargo::rustc-cfg=ossl_mlkem")
-        }
-    }
-
+    // FIXME for openssl-sys
     fn func_macro(&self, name: &str, _value: &[&[u8]]) {
         if name == "OSSL_PARAM_clear_free" {
             println!("cargo::rustc-cfg=param_clear_free")
         }
     }
 }
 
+#[cfg(not(feature = "dynamic"))]
 fn ossl_bindings(args: &mut Vec<String>, out_file: &Path) {
     if let Some(var) = env::var("OSSL_BINDGEN_CLANG_ARGS").ok() {
         for arg in var.split_whitespace() {
@@ -108,6 +104,7 @@ fn ossl_bindings(args: &mut Vec<String>, out_file: &Path) {
         .expect("Couldn't write bindings!");
 }
 
+#[cfg(not(feature = "dynamic"))]
 fn build_ossl(out_file: &Path) {
     let sources = std::env::var("KRYOPTIC_OPENSSL_SOURCES")
         .expect("Env var KRYOPTIC_OPENSSL_SOURCES is not defined");
@@ -281,20 +278,6 @@ fn build_ossl(out_file: &Path) {
     ossl_bindings(&mut args, out_file);
 }
 
-fn use_system_ossl(out_file: &Path) {
-    let library = pkg_config::Config::new()
-        .atleast_version("3.0.7")
-        .probe("openssl")
-        .unwrap();
-
-    let mut args: Vec<String> = Vec::new();
-    for include_path in library.include_paths {
-        args.push(["-I", include_path.to_str().unwrap()].concat());
-    }
-
-    ossl_bindings(&mut args, out_file);
-}
-
 fn set_pretty_panic() {
     set_hook(Box::new(|panic_info| {
         if let Some(s) = panic_info.payload().downcast_ref::<&str>() {
@@ -322,20 +305,36 @@ fn set_pretty_panic() {
 fn main() {
     set_pretty_panic();
 
-    let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
-    let ossl_bindings = out_path.join("ossl_bindings.rs");
-
     /* Always emit known configs */
     println!(
-        "cargo::rustc-check-cfg=cfg(ossl_v307,ossl_v320,ossl_v350,ossl_v400,ossl_mldsa,ossl_mlkem,ossl_slhdsa,param_clear_free)"
+        "cargo::rustc-check-cfg=cfg(ossl_v307,ossl_v320,ossl_v350,ossl_v400,param_clear_free)"
     );
 
     /* OpenSSL Cryptography */
-    if cfg!(feature = "dynamic") {
-        use_system_ossl(&ossl_bindings);
-    } else {
+    #[cfg(not(feature = "dynamic"))]
+    {
+        let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+        let ossl_bindings = out_path.join("ossl_bindings.rs");
         build_ossl(&ossl_bindings);
     }
 
+    #[cfg(feature = "dynamic")]
+    if let Ok(v) = env::var("DEP_OPENSSL_VERSION_NUMBER") {
+        let version = i64::from_str_radix(&v, 16).unwrap();
+        check_ossl_version(version);
+        // Proxy it also to the code for the api_level() API
+        println!("cargo:rustc-env=DEP_OPENSSL_VERSION_NUMBER={}", v);
+
+        // backward compatible OPENSSL_FULL_VERSION_STR
+        let major = (version >> 28) & 0xF;
+        let minor = (version >> 20) & 0xFF;
+        let patch = (version >> 4) & 0xFF;
+        let version_string = format!("{}.{}.{}", major, minor, patch);
+        println!(
+            "cargo:rustc-env=OPENSSL_FULL_VERSION_STR={}",
+            version_string
+        );
+    }
+
     println!("cargo:rerun-if-changed=build.rs");
 }

ossl/src/lib.rs

@@ -8,6 +8,7 @@
 /// Part of this module is automatically generated by bindgen from the OpenSSL
 /// Headers and includes a selection of functions and other items needed to
 /// access the libcrypto/libfips functions needed.
+#[cfg(not(feature = "dynamic"))]
 pub mod bindings {
     #![allow(non_upper_case_globals)]
     #![allow(non_camel_case_types)]
@@ -16,6 +17,15 @@ pub mod bindings {
     #![allow(unnecessary_transmutes)]
     include!(concat!(env!("OUT_DIR"), "/ossl_bindings.rs"));
 }
+#[cfg(feature = "dynamic")]
+pub mod bindings {
+    #![allow(non_upper_case_globals)]
+    include!("missing_ossl_bindings.rs");
+    pub use openssl_sys::*;
+    // backward compatible definitions
+    pub const OPENSSL_FULL_VERSION_STR: &[u8] =
+        concat!(env!("OPENSSL_FULL_VERSION_STR"), "\0").as_bytes();
+}
 
 use std::borrow::Cow;
 use std::ffi::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, CStr};
@@ -43,10 +53,27 @@ pub mod fips;
 /// This returns a triplet of u8 values representing Major, Minor, and
 /// Patch version.
 pub fn api_level() -> (u8, u8, u8) {
-    let patch: u8 = (OPENSSL_API_LEVEL & 0xff) as u8;
-    let minor: u8 = ((OPENSSL_API_LEVEL & 0xff00) >> 8) as u8;
-    let major: u8 = ((OPENSSL_API_LEVEL & 0xff0000) >> 16) as u8;
-    (major, minor, patch)
+    #[cfg(not(feature = "dynamic"))]
+    {
+        // This is the 0xMMNNPP (Major, miNor, Patch) scheme
+        let version = OPENSSL_API_LEVEL;
+        let patch: u8 = (version & 0xff) as u8;
+        let minor: u8 = ((version & 0xff00) >> 8) as u8;
+        let major: u8 = ((version & 0xff0000) >> 16) as u8;
+        (major, minor, patch)
+    }
+
+    #[cfg(feature = "dynamic")]
+    {
+        // This is the 0xMNN00PP0 (Major, miNor, Patch) scheme
+        let v = env!("DEP_OPENSSL_VERSION_NUMBER");
+        let version = u64::from_str_radix(&v, 16).unwrap();
+
+        let patch: u8 = ((version & 0xff0) >> 4) as u8;
+        let minor: u8 = ((version & 0xff00000) >> 20) as u8;
+        let major: u8 = ((version & 0xff0000000) >> 28) as u8;
+        (major, minor, patch)
+    }
 }
 
 /// Securely zeroizes a memory slice using `OPENSSL_cleanse`.