Build against openssl-sys low-level bindings

Linking applications against different bindings to the same library
(openssl) is undefined behavior in rust ecosystem.

This is removing the low-level bindings and bindgen dependency,
delefating this to the openssl-sys crate providing all the low-level
functions.

Unfortunately, it does not expose all the constants and defines,
that need to be defined manually.

The direct static linking to libfips is preserved.

Signed-off-by: Jakub Jelen <jjelen@redhat.com>

Author: Jakuje

.github/workflows/rpm.yml

@@ -56,7 +56,7 @@ jobs:
                 'crate(num-integer/default)' 'crate(num-traits/default)' \
                 'crate(pkg-config/default)' 'crate(rusqlite/default)' \
                 'crate(serde/default)' 'crate(serde/derive)' 'crate(serde_json/default)' \
-                'crate(serial_test/default)' \
+                'crate(serial_test/default)' '(crate(itertools/default)' '(crate(openssl-sys/bindgen)' \
                 'crate(toml)' 'crate(toml/display)' 'crate(toml/parse)' 'crate(toml/serde)' \
                 'crate(uuid/default)' 'crate(uuid/v4)' 'crate(uuid/v8)' 'crate(cryptoki/default)' \
                 'crate(vsprintf/default)' 'crate(quick-xml/default)' 'crate(quick-xml/serialize)'

ossl/Cargo.toml

@@ -1,6 +1,5 @@
 [package]
 name = "ossl"
-links = "openssl"
 version.workspace = true
 edition.workspace = true
 description = "OpenSSL version 3+ bindings to modern EVP APIs"
@@ -12,14 +11,15 @@ license = "Apache-2.0"
 test = true
 
 [build-dependencies]
-bindgen = "0.72"
+bindgen = { version = "0.72", optional = true}
 pkg-config = "0.3"
 
 [dependencies]
 cfg-if = "1.0.0"
 libc = "0.2.151"
 log = { version = "0.4.27", default-features = false, features = ["std"], optional = true }
 vsprintf = { version = "2.0.0", optional = true }
+openssl-sys = { version = "0.9.117", features = ["bindgen"], optional = true }
 
 [dev-dependencies]
 hex = "0.4.3"
@@ -29,8 +29,8 @@ serial_test = "3.1.1"
 ossl320 = [] # Requires at a minimum OpenSSL 3.2.0
 ossl350 = [] # Requires at a minimum OpenSSL 3.5.0
 ossl400 = [] # Requires at minimum OpenSSL 4.0
-dynamic = [] # Builds against system libcrypto.so
-fips = ["ossl350"] # Builds against sources and libfips.a instead of libcrypto
+dynamic = ["dep:openssl-sys"] # Builds against system libcrypto.so
+fips = ["ossl350", "dep:bindgen"] # Builds against sources and libfips.a instead of libcrypto
 log = ["dep:log", "dep:vsprintf"] # Error tracing using log crate
 rfc9580 = [] # Enables features required for OpenPGP implementations
 

ossl/build.rs

@@ -3,6 +3,7 @@
 
 use std::env;
 use std::panic::set_hook;
+#[cfg(not(feature = "dynamic"))]
 use std::path::{Path, PathBuf};
 
 #[derive(Debug)]
@@ -12,68 +13,63 @@ const OPENSSL_3_2_0: i64 = 0x30200000;
 const OPENSSL_3_5_0: i64 = 0x30500000;
 const OPENSSL_4_0_0: i64 = 0x40000000;
 
+fn check_ossl_version(version: i64) {
+    if version < OPENSSL_4_0_0 {
+        #[cfg(feature = "ossl400")]
+        panic!("OpenSSL 4.0.0 or later is required");
+    }
+    if version < OPENSSL_3_5_0 {
+        #[cfg(feature = "ossl350")]
+        panic!("OpenSSL 3.5.0 or later is required");
+    }
+    if version < OPENSSL_3_2_0 {
+        #[cfg(feature = "ossl320")]
+        panic!("OpenSSL 3.2.0 or later is required");
+    }
+    if version < OPENSSL_3_0_7 {
+        panic!(
+            "OpenSSL 3.0.7 is the minimum viable version. Found {:x}",
+            version
+        );
+    }
+    /* Emit versions we found, versions stack, so code
+     * just need to build conditionalized just to the older version
+     * that introduced the desired feature */
+    println!("cargo::rustc-cfg=ossl_v307");
+    if version >= OPENSSL_3_2_0 {
+        println!("cargo::rustc-cfg=ossl_v320");
+    }
+    if version >= OPENSSL_3_5_0 {
+        println!("cargo::rustc-cfg=ossl_v350");
+    }
+    if version >= OPENSSL_4_0_0 {
+        println!("cargo::rustc-cfg=ossl_v400");
+    }
+}
+
+#[cfg(not(feature = "dynamic"))]
 impl bindgen::callbacks::ParseCallbacks for OsslCallbacks {
     fn int_macro(
         &self,
         name: &str,
         value: i64,
     ) -> Option<bindgen::callbacks::IntKind> {
         if name == "OPENSSL_VERSION_NUMBER" {
-            if value < OPENSSL_4_0_0 {
-                #[cfg(feature = "ossl400")]
-                panic!("OpenSSL 4.0.0 or later is required");
-            }
-            if value < OPENSSL_3_5_0 {
-                #[cfg(feature = "ossl350")]
-                panic!("OpenSSL 3.5.0 or later is required");
-            }
-            if value < OPENSSL_3_2_0 {
-                #[cfg(feature = "ossl320")]
-                panic!("OpenSSL 3.2.0 or later is required");
-            }
-            if value < OPENSSL_3_0_7 {
-                panic!(
-                    "OpenSSL 3.0.7 is the minimum viable version. Found {:x}",
-                    value
-                );
-            }
-            /* Emit versions we found, versions stack, so code
-             * just need to build conditionalized just to the older version
-             * that introduced the desired feature */
-            println!("cargo::rustc-cfg=ossl_v307");
-            if value >= OPENSSL_3_2_0 {
-                println!("cargo::rustc-cfg=ossl_v320");
-            }
-            if value >= OPENSSL_3_5_0 {
-                println!("cargo::rustc-cfg=ossl_v350");
-            }
-            if value >= OPENSSL_4_0_0 {
-                println!("cargo::rustc-cfg=ossl_v400");
-            }
+            check_ossl_version(value);
         }
 
         None
     }
 
-    fn str_macro(&self, name: &str, _value: &[u8]) {
-        if name == "OSSL_PKEY_PARAM_SLH_DSA_SEED" {
-            println!("cargo::rustc-cfg=ossl_slhdsa")
-        }
-        if name == "OSSL_PKEY_PARAM_ML_DSA_SEED" {
-            println!("cargo::rustc-cfg=ossl_mldsa")
-        }
-        if name == "OSSL_PKEY_PARAM_ML_KEM_SEED" {
-            println!("cargo::rustc-cfg=ossl_mlkem")
-        }
-    }
-
+    // FIXME for openssl-sys
     fn func_macro(&self, name: &str, _value: &[&[u8]]) {
         if name == "OSSL_PARAM_clear_free" {
             println!("cargo::rustc-cfg=param_clear_free")
         }
     }
 }
 
+#[cfg(not(feature = "dynamic"))]
 fn ossl_bindings(args: &mut Vec<String>, out_file: &Path) {
     if let Some(var) = env::var("OSSL_BINDGEN_CLANG_ARGS").ok() {
         for arg in var.split_whitespace() {
@@ -108,6 +104,7 @@ fn ossl_bindings(args: &mut Vec<String>, out_file: &Path) {
         .expect("Couldn't write bindings!");
 }
 
+#[cfg(not(feature = "dynamic"))]
 fn build_ossl(out_file: &Path) {
     let sources = std::env::var("KRYOPTIC_OPENSSL_SOURCES")
         .expect("Env var KRYOPTIC_OPENSSL_SOURCES is not defined");
@@ -281,19 +278,19 @@ fn build_ossl(out_file: &Path) {
     ossl_bindings(&mut args, out_file);
 }
 
-fn use_system_ossl(out_file: &Path) {
-    let library = pkg_config::Config::new()
-        .atleast_version("3.0.7")
-        .probe("openssl")
-        .unwrap();
-
-    let mut args: Vec<String> = Vec::new();
-    for include_path in library.include_paths {
-        args.push(["-I", include_path.to_str().unwrap()].concat());
-    }
-
-    ossl_bindings(&mut args, out_file);
-}
+//fn use_system_ossl(out_file: &Path) {
+//    let library = pkg_config::Config::new()
+//        .atleast_version("3.0.7")
+//        .probe("openssl")
+//        .unwrap();
+//
+//    let mut args: Vec<String> = Vec::new();
+//    for include_path in library.include_paths {
+//        args.push(["-I", include_path.to_str().unwrap()].concat());
+//    }
+//
+//    ossl_bindings(&mut args, out_file);
+//}
 
 fn set_pretty_panic() {
     set_hook(Box::new(|panic_info| {
@@ -322,20 +319,26 @@ fn set_pretty_panic() {
 fn main() {
     set_pretty_panic();
 
-    let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
-    let ossl_bindings = out_path.join("ossl_bindings.rs");
-
     /* Always emit known configs */
     println!(
-        "cargo::rustc-check-cfg=cfg(ossl_v307,ossl_v320,ossl_v350,ossl_v400,ossl_mldsa,ossl_mlkem,ossl_slhdsa,param_clear_free)"
+        "cargo::rustc-check-cfg=cfg(ossl_v307,ossl_v320,ossl_v350,ossl_v400,param_clear_free)"
     );
 
     /* OpenSSL Cryptography */
-    if cfg!(feature = "dynamic") {
-        use_system_ossl(&ossl_bindings);
-    } else {
+    #[cfg(not(feature = "dynamic"))]
+    {
+        let out_path = PathBuf::from(env::var("OUT_DIR").unwrap());
+        let ossl_bindings = out_path.join("ossl_bindings.rs");
         build_ossl(&ossl_bindings);
     }
 
+    #[cfg(feature = "dynamic")]
+    if let Ok(v) = env::var("DEP_OPENSSL_VERSION_NUMBER") {
+        let version = i64::from_str_radix(&v, 16).unwrap();
+        check_ossl_version(version);
+        // Proxy it also to the code for the api_level() API
+        println!("cargo:rustc-env=DEP_OPENSSL_VERSION_NUMBER={}", version);
+    }
+
     println!("cargo:rerun-if-changed=build.rs");
 }

ossl/src/asymcipher.rs

@@ -8,6 +8,8 @@ use crate::bindings::*;
 use crate::digest::{digest_to_string, DigestAlg};
 use crate::pkey::{EvpPkey, EvpPkeyCtx};
 use crate::{cstr, trace_ossl, Error, ErrorKind, OsslContext, OsslParam};
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 /// Known algorithms selectable for OsslAsymcipher
 #[derive(Clone, Copy, Debug, PartialEq)]

ossl/src/cipher.rs

@@ -11,6 +11,8 @@ use crate::{
     cstr, trace_ossl, Error, ErrorKind, OsslContext, OsslParam,
     OsslParamBuilder, OsslSecret,
 };
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 /// Wrapper around OpenSSL's `EVP_CIPHER`, managing its lifecycle.
 #[derive(Debug)]

ossl/src/derive.rs

@@ -14,6 +14,8 @@ use crate::{
     cstr, trace_ossl, Error, ErrorKind, OsslContext, OsslParam,
     OsslParamBuilder,
 };
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 /// Wrapper around OpenSSL's `EVP_KDF_CTX`, managing its lifecycle.
 #[derive(Debug)]

ossl/src/digest.rs

@@ -6,6 +6,8 @@
 use std::ffi::{c_uint, c_void, CStr};
 
 use crate::bindings::*;
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 use crate::{cstr, trace_ossl, Error, ErrorKind, OsslContext, OsslParam};
 

ossl/src/fips.rs

@@ -11,6 +11,8 @@ use crate::bindings::*;
 use crate::pkey::EvpPkey;
 use crate::signature::SigAlg;
 use crate::{Error, ErrorKind, OsslContext};
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 pub fn set_error_state() {
     unsafe {

ossl/src/lib.rs

@@ -8,6 +8,7 @@
 /// Part of this module is automatically generated by bindgen from the OpenSSL
 /// Headers and includes a selection of functions and other items needed to
 /// access the libcrypto/libfips functions needed.
+#[cfg(not(feature = "dynamic"))]
 pub mod bindings {
     #![allow(non_upper_case_globals)]
     #![allow(non_camel_case_types)]
@@ -16,11 +17,19 @@ pub mod bindings {
     #![allow(unnecessary_transmutes)]
     include!(concat!(env!("OUT_DIR"), "/ossl_bindings.rs"));
 }
+#[cfg(feature = "dynamic")]
+pub mod bindings {
+    #![allow(non_upper_case_globals)]
+    include!("missing_ossl_bindings.rs");
+}
 
 use std::borrow::Cow;
 use std::ffi::{c_char, c_int, c_long, c_uchar, c_uint, c_ulong, c_void, CStr};
 
+#[allow(unused_imports)]
 use crate::bindings::*;
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 pub mod asymcipher;
 pub mod cipher;
@@ -34,6 +43,8 @@ pub mod signature;
 #[cfg(feature = "fips")]
 pub mod fips;
 
+pub const OSSL_PARAM_UTF8_STRING: u32 = 4;
+
 /// Export the API level of the OpenSSL library these bindings
 /// were built against. This should be used only when probing
 /// for behavior is difficult as it is only a proxy for what was
@@ -43,10 +54,24 @@ pub mod fips;
 /// This returns a triplet of u8 values representing Major, Minor, and
 /// Patch version.
 pub fn api_level() -> (u8, u8, u8) {
-    let patch: u8 = (OPENSSL_API_LEVEL & 0xff) as u8;
-    let minor: u8 = ((OPENSSL_API_LEVEL & 0xff00) >> 8) as u8;
-    let major: u8 = ((OPENSSL_API_LEVEL & 0xff0000) >> 16) as u8;
-    (major, minor, patch)
+    #[cfg(not(feature = "dynamic"))]
+    {
+        let patch: u8 = (OPENSSL_API_LEVEL & 0xff) as u8;
+        let minor: u8 = ((OPENSSL_API_LEVEL & 0xff00) >> 8) as u8;
+        let major: u8 = ((OPENSSL_API_LEVEL & 0xff0000) >> 16) as u8;
+        return (major, minor, patch);
+    }
+
+    #[cfg(feature = "dynamic")]
+    {
+        let v = env!("DEP_OPENSSL_VERSION_NUMBER");
+        let version = u64::from_str_radix(&v, 16).unwrap();
+
+        let patch: u8 = (version & 0xff) as u8;
+        let minor: u8 = ((version & 0xff00) >> 8) as u8;
+        let major: u8 = ((version & 0xff0000) >> 16) as u8;
+        (major, minor, patch)
+    }
 }
 
 /// Securely zeroizes a memory slice using `OPENSSL_cleanse`.

ossl/src/mac.rs

@@ -11,6 +11,8 @@ use crate::{
     cstr, trace_ossl, Error, ErrorKind, OsslContext, OsslParamBuilder,
     OsslSecret,
 };
+#[cfg(feature = "dynamic")]
+use openssl_sys::*;
 
 /// Wrapper around OpenSSL's `EVP_MAC_CTX`, managing its lifecycle.
 #[derive(Debug)]