Add a feature to build against openssl-sys low-level bindings

Linking applications against different bindings to the same library
(openssl) is undefined behavior in rust ecosystem.

This is adding another feature to get the low-level binding from
openssl-sys crate (enabled by default).

Unfortunately, it does not expose all the constants and defines,
that need to be defined manually.

The direct static linking to libfips is preserved, as well as
the old dynamic linking through our bindgen for now.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

Author: Jakuje

.github/workflows/build.yml

@@ -18,7 +18,7 @@ jobs:
       fail-fast: false
       matrix:
         name: [standard, i686, minimal, pqc, no_sha1]
-        linking: [dynamic, static, fips]
+        linking: [dynamic, static, fips, openssl-sys]
         build: [debug, release]
         db: [sqlitedb, nssdb]
         exclude:
@@ -162,6 +162,8 @@ jobs:
             FEATURES="${FEATURES},${FEATURE_SET},ossl400"
           elif [ "${{ matrix.linking }}" = "fips" ]; then
             FEATURES="${FEATURES},fips"
+          elif [ "${{ matrix.linking }}" = "openssl-sys" ]; then
+            FEATURES="${FEATURES},${FEATURE_SET},openssl-sys"
           fi
 
           if [ "${{ matrix.build }}" = "release" ]; then

.github/workflows/rpm.yml

@@ -56,7 +56,7 @@ jobs:
                 'crate(num-integer/default)' 'crate(num-traits/default)' \
                 'crate(pkg-config/default)' 'crate(rusqlite/default)' \
                 'crate(serde/default)' 'crate(serde/derive)' 'crate(serde_json/default)' \
-                'crate(serial_test/default)' \
+                'crate(serial_test/default)' 'crate(openssl-sys/bindgen)' \
                 'crate(toml)' 'crate(toml/display)' 'crate(toml/parse)' 'crate(toml/serde)' \
                 'crate(uuid/default)' 'crate(uuid/v4)' 'crate(uuid/v8)' 'crate(cryptoki/default)' \
                 'crate(vsprintf/default)' 'crate(quick-xml/default)' 'crate(quick-xml/serialize)'

Cargo.toml

@@ -112,6 +112,7 @@ fips = ["ossl/fips", "sqlitedb", "rusqlite/bundled", "aes", "ecc_all", "ffdh",
 "hash_all", "kdf_all", "rsa", "pqc", "dep:vsprintf"]
 
 dynamic = ["ossl/dynamic"] # Builds against system libcrypto.so
+openssl-sys = ["ossl/openssl-sys"] # Builds against system libcrypto through openssl-sys
 
 log = ["dep:log", "dep:simplelog", "ossl/log"] # Enables error/info tracing
 slow = [] # Enables slow tests

ossl/Cargo.toml

@@ -1,6 +1,5 @@
 [package]
 name = "ossl"
-links = "openssl"
 version.workspace = true
 edition.workspace = true
 description = "OpenSSL version 3+ bindings to modern EVP APIs"
@@ -16,19 +15,24 @@ bindgen = "0.72"
 pkg-config = "0.3"
 
 [dependencies]
+bitflags = "2.4.1"
 cfg-if = "1.0.0"
 libc = "0.2.151"
 log = { version = "0.4.27", default-features = false, features = ["std"], optional = true }
 vsprintf = { version = "2.0.0", optional = true }
+openssl-sys = { version = "0.9", features = ["bindgen"], optional = true }
 
 [dev-dependencies]
 hex = "0.4.3"
 serial_test = "3.1.1"
 
 [features]
+default = ["openssl-sys"]
+
 ossl320 = [] # Requires at a minimum OpenSSL 3.2.0
 ossl350 = [] # Requires at a minimum OpenSSL 3.5.0
 ossl400 = [] # Requires at minimum OpenSSL 4.0
+openssl-sys = ["dep:openssl-sys"]
 dynamic = [] # Builds against system libcrypto.so
 fips = ["ossl350"] # Builds against sources and libfips.a instead of libcrypto
 log = ["dep:log", "dep:vsprintf"] # Error tracing using log crate

ossl/build.rs

@@ -12,66 +12,52 @@ const OPENSSL_3_2_0: i64 = 0x30200000;
 const OPENSSL_3_5_0: i64 = 0x30500000;
 const OPENSSL_4_0_0: i64 = 0x40000000;
 
+fn check_ossl_version(version: i64) {
+    if version < OPENSSL_4_0_0 {
+        #[cfg(feature = "ossl400")]
+        panic!("OpenSSL 4.0.0 or later is required");
+    }
+    if version < OPENSSL_3_5_0 {
+        #[cfg(feature = "ossl350")]
+        panic!("OpenSSL 3.5.0 or later is required");
+    }
+    if version < OPENSSL_3_2_0 {
+        #[cfg(feature = "ossl320")]
+        panic!("OpenSSL 3.2.0 or later is required");
+    }
+    if version < OPENSSL_3_0_7 {
+        panic!(
+            "OpenSSL 3.0.7 is the minimum viable version. Found {:x}",
+            version
+        );
+    }
+    /* Emit versions we found, versions stack, so code
+     * just need to build conditionalized just to the older version
+     * that introduced the desired feature */
+    println!("cargo::rustc-cfg=ossl_v307");
+    if version >= OPENSSL_3_2_0 {
+        println!("cargo::rustc-cfg=ossl_v320");
+    }
+    if version >= OPENSSL_3_5_0 {
+        println!("cargo::rustc-cfg=ossl_v350");
+    }
+    if version >= OPENSSL_4_0_0 {
+        println!("cargo::rustc-cfg=ossl_v400");
+    }
+}
+
 impl bindgen::callbacks::ParseCallbacks for OsslCallbacks {
     fn int_macro(
         &self,
         name: &str,
         value: i64,
     ) -> Option<bindgen::callbacks::IntKind> {
         if name == "OPENSSL_VERSION_NUMBER" {
-            if value < OPENSSL_4_0_0 {
-                #[cfg(feature = "ossl400")]
-                panic!("OpenSSL 4.0.0 or later is required");
-            }
-            if value < OPENSSL_3_5_0 {
-                #[cfg(feature = "ossl350")]
-                panic!("OpenSSL 3.5.0 or later is required");
-            }
-            if value < OPENSSL_3_2_0 {
-                #[cfg(feature = "ossl320")]
-                panic!("OpenSSL 3.2.0 or later is required");
-            }
-            if value < OPENSSL_3_0_7 {
-                panic!(
-                    "OpenSSL 3.0.7 is the minimum viable version. Found {:x}",
-                    value
-                );
-            }
-            /* Emit versions we found, versions stack, so code
-             * just need to build conditionalized just to the older version
-             * that introduced the desired feature */
-            println!("cargo::rustc-cfg=ossl_v307");
-            if value >= OPENSSL_3_2_0 {
-                println!("cargo::rustc-cfg=ossl_v320");
-            }
-            if value >= OPENSSL_3_5_0 {
-                println!("cargo::rustc-cfg=ossl_v350");
-            }
-            if value >= OPENSSL_4_0_0 {
-                println!("cargo::rustc-cfg=ossl_v400");
-            }
+            check_ossl_version(value);
         }
 
         None
     }
-
-    fn str_macro(&self, name: &str, _value: &[u8]) {
-        if name == "OSSL_PKEY_PARAM_SLH_DSA_SEED" {
-            println!("cargo::rustc-cfg=ossl_slhdsa")
-        }
-        if name == "OSSL_PKEY_PARAM_ML_DSA_SEED" {
-            println!("cargo::rustc-cfg=ossl_mldsa")
-        }
-        if name == "OSSL_PKEY_PARAM_ML_KEM_SEED" {
-            println!("cargo::rustc-cfg=ossl_mlkem")
-        }
-    }
-
-    fn func_macro(&self, name: &str, _value: &[&[u8]]) {
-        if name == "OSSL_PARAM_clear_free" {
-            println!("cargo::rustc-cfg=param_clear_free")
-        }
-    }
 }
 
 fn ossl_bindings(args: &mut Vec<String>, out_file: &Path) {
@@ -322,19 +308,37 @@ fn set_pretty_panic() {
 fn main() {
     set_pretty_panic();
 
-    let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
-    let ossl_bindings = out_path.join("ossl_bindings.rs");
-
     /* Always emit known configs */
     println!(
-        "cargo::rustc-check-cfg=cfg(ossl_v307,ossl_v320,ossl_v350,ossl_v400,ossl_mldsa,ossl_mlkem,ossl_slhdsa,param_clear_free)"
+        "cargo::rustc-check-cfg=cfg(ossl_v307,ossl_v320,ossl_v350,ossl_v400)"
     );
 
     /* OpenSSL Cryptography */
-    if cfg!(feature = "dynamic") {
-        use_system_ossl(&ossl_bindings);
+    if cfg!(feature = "openssl-sys") {
+        if let Ok(v) = env::var("DEP_OPENSSL_VERSION_NUMBER") {
+            let version = i64::from_str_radix(&v, 16).unwrap();
+            check_ossl_version(version);
+            // Proxy it also to the code for the api_level() API
+            println!("cargo:rustc-env=DEP_OPENSSL_VERSION_NUMBER={}", v);
+
+            // backward compatible OPENSSL_FULL_VERSION_STR
+            let major = (version >> 28) & 0xF;
+            let minor = (version >> 20) & 0xFF;
+            let patch = (version >> 4) & 0xFF;
+            let version_string = format!("{}.{}.{}", major, minor, patch);
+            println!(
+                "cargo:rustc-env=OPENSSL_FULL_VERSION_STR={}",
+                version_string
+            );
+        }
     } else {
-        build_ossl(&ossl_bindings);
+        let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+        let ossl_bindings = out_path.join("ossl_bindings.rs");
+        if cfg!(feature = "dynamic") {
+            use_system_ossl(&ossl_bindings);
+        } else {
+            build_ossl(&ossl_bindings);
+        }
     }
 
     println!("cargo:rerun-if-changed=build.rs");

ossl/src/lib.rs

@@ -8,6 +8,7 @@
 /// Part of this module is automatically generated by bindgen from the OpenSSL
 /// Headers and includes a selection of functions and other items needed to
 /// access the libcrypto/libfips functions needed.
+#[cfg(not(feature = "openssl-sys"))]
 pub mod bindings {
     #![allow(non_upper_case_globals)]
     #![allow(non_camel_case_types)]
@@ -16,6 +17,15 @@ pub mod bindings {
     #![allow(unnecessary_transmutes)]
     include!(concat!(env!("OUT_DIR"), "/ossl_bindings.rs"));
 }
+#[cfg(feature = "openssl-sys")]
+pub mod bindings {
+    #![allow(non_upper_case_globals)]
+    include!("non-openssl-sys-bindings.rs");
+    pub use openssl_sys::*;
+    // backward compatible definitions
+    pub const OPENSSL_FULL_VERSION_STR: &[u8] =
+        concat!(env!("OPENSSL_FULL_VERSION_STR"), "\0").as_bytes();
+}
 
 use std::borrow::Cow;
 use std::ffi::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, CStr};
@@ -43,10 +53,27 @@ pub mod fips;
 /// This returns a triplet of u8 values representing Major, Minor, and
 /// Patch version.
 pub fn api_level() -> (u8, u8, u8) {
-    let patch: u8 = (OPENSSL_API_LEVEL & 0xff) as u8;
-    let minor: u8 = ((OPENSSL_API_LEVEL & 0xff00) >> 8) as u8;
-    let major: u8 = ((OPENSSL_API_LEVEL & 0xff0000) >> 16) as u8;
-    (major, minor, patch)
+    #[cfg(not(feature = "openssl-sys"))]
+    {
+        // This is the 0xMMNNPP (Major, miNor, Patch) scheme
+        let version = OPENSSL_API_LEVEL;
+        let patch: u8 = (version & 0xff) as u8;
+        let minor: u8 = ((version & 0xff00) >> 8) as u8;
+        let major: u8 = ((version & 0xff0000) >> 16) as u8;
+        (major, minor, patch)
+    }
+
+    #[cfg(feature = "openssl-sys")]
+    {
+        // This is the 0xMNN00PP0 (Major, miNor, Patch) scheme
+        let v = env!("DEP_OPENSSL_VERSION_NUMBER");
+        let version = u64::from_str_radix(&v, 16).unwrap();
+
+        let patch: u8 = ((version & 0xff0) >> 4) as u8;
+        let minor: u8 = ((version & 0xff00000) >> 20) as u8;
+        let major: u8 = ((version & 0xff0000000) >> 28) as u8;
+        (major, minor, patch)
+    }
 }
 
 /// Securely zeroizes a memory slice using `OPENSSL_cleanse`.
@@ -496,13 +523,13 @@ pub struct OsslParam<'a>(OsslParamBuilder<'a>);
 impl Drop for OsslParamBuilder<'_> {
     fn drop(&mut self) {
         if self.freeptr {
-            #[cfg(param_clear_free)]
+            #[cfg(ossl_v400)]
             unsafe {
                 OSSL_PARAM_clear_free(
                     self.p.as_ref().as_ptr() as *mut OSSL_PARAM
                 );
             }
-            #[cfg(not(param_clear_free))]
+            #[cfg(not(ossl_v400))]
             unsafe {
                 OSSL_PARAM_free(self.p.as_ref().as_ptr() as *mut OSSL_PARAM);
             }