Skip to content

Update cert compression reporting #13197

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bneradt wants to merge 1 commit into
base: master
Choose a base branch
from
+88 −41
Open

Update cert compression reporting #13197

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 48 additions & 35 deletions src/iocore/net/TLSCertCompression.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,9 @@ namespace
DbgCtl dbg_ctl_ssl_cert_compress{"ssl_cert_compress"};
}

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG || HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE
constexpr unsigned int N_ALGORITHMS = 3;
#endif

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
#include "TLSCertCompression_zlib.h"
Expand All @@ -53,70 +55,81 @@ struct alg_info {
ssl_cert_decompression_func_t decompress_func;
#endif
} supported_algs[] = {
{"zlib", 1,
#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
compression_func_zlib, decompression_func_zlib
#endif
},
{"zlib", 1, compression_func_zlib, decompression_func_zlib },
#if HAVE_BROTLI_ENCODE_H
{"brotli", 2,
#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
compression_func_brotli, decompression_func_brotli
#endif
},
{"brotli", 2, compression_func_brotli, decompression_func_brotli},
#endif
#if HAVE_ZSTD_H
{"zstd", 3,
#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
compression_func_zstd, decompression_func_zstd
{"zstd", 3, compression_func_zstd, decompression_func_zstd },
#endif
{nullptr, 0, nullptr, nullptr },
#else
#if HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE && !defined(OPENSSL_NO_ZLIB)
{"zlib", 1},
#endif
#if HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE && !defined(OPENSSL_NO_BROTLI)
{"brotli", 2},
#endif
},
#if HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE && !defined(OPENSSL_NO_ZSTD)
{"zstd", 3},
#endif
{nullptr, 0},
#endif
};

alg_info const *
find_algorithm(std::string const &name)
{
for (auto const &alg : supported_algs) {
if (alg.name != nullptr && name == alg.name) {
return &alg;
}
}
return nullptr;
}

int
register_certificate_compression_preference(SSL_CTX *ctx, const std::vector<std::string> &specified_algs)
{
ink_assert(ctx != nullptr);
if (specified_algs.size() > N_ALGORITHMS) {
return 0;
}

if (specified_algs.empty()) {
return 1;
}

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
for (auto &&alg : specified_algs) {
struct alg_info *info = nullptr;
if (specified_algs.size() > N_ALGORITHMS) {
return 0;
}

for (unsigned int i = 0; i < countof(supported_algs); ++i) {
if (strcmp(alg.c_str(), supported_algs[i].name) == 0) {
info = &supported_algs[i];
}
for (auto &&alg : specified_algs) {
auto const *info = find_algorithm(alg);
if (info == nullptr) {
Dbg(dbg_ctl_ssl_cert_compress, "Unsupported algorithm: %s", alg.c_str());
return 0;
}
if (info != nullptr) {
if (SSL_CTX_add_cert_compression_alg(ctx, info->number, info->compress_func, info->decompress_func) == 0) {
return 0;
}
Dbg(dbg_ctl_ssl_cert_compress, "Enabled %s", info->name);
} else {
Dbg(dbg_ctl_ssl_cert_compress, "Unrecognized algorithm: %s", alg.c_str());
if (SSL_CTX_add_cert_compression_alg(ctx, info->number, info->compress_func, info->decompress_func) == 0) {
return 0;
}
Dbg(dbg_ctl_ssl_cert_compress, "Enabled %s", info->name);
}
return 1;
#elif HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE
if (specified_algs.size() > N_ALGORITHMS) {
return 0;
}

int algs[N_ALGORITHMS];
int n = 0;

for (unsigned int i = 0; i < specified_algs.size(); ++i) {
for (unsigned int j = 0; j < countof(supported_algs); ++j) {
if (strcmp(specified_algs[i].c_str(), supported_algs[j].name) == 0) {
algs[n++] = supported_algs[j].number;
Dbg(dbg_ctl_ssl_cert_compress, "Enabled %s", supported_algs[j].name);
}
auto const *info = find_algorithm(specified_algs[i]);
if (info == nullptr) {
Dbg(dbg_ctl_ssl_cert_compress, "Unsupported algorithm: %s", specified_algs[i].c_str());
return 0;
}
algs[n++] = info->number;
Dbg(dbg_ctl_ssl_cert_compress, "Enabled %s", info->name);
}
return SSL_CTX_set1_cert_comp_preference(ctx, algs, n);
#else
Expand Down
44 changes: 39 additions & 5 deletions src/traffic_layout/info.cc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@

#include <fcntl.h>
#include <openssl/crypto.h>
#include <openssl/ssl.h>
#include <swoc/BufferWriter.h>
#include <swoc/bwf_base.h>
#include "tscore/Layout.h"
Expand Down Expand Up @@ -53,6 +54,39 @@
#include <zstd.h>
#endif

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
static constexpr int ts_has_cert_compression_callbacks = 1;
#else
static constexpr int ts_has_cert_compression_callbacks = 0;
#endif

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG
static constexpr int ts_has_cert_compression_zlib = 1;
#elif HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE && !defined(OPENSSL_NO_ZLIB)
static constexpr int ts_has_cert_compression_zlib = 1;
#else
static constexpr int ts_has_cert_compression_zlib = 0;
#endif

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG && HAVE_BROTLI_ENCODE_H
static constexpr int ts_has_cert_compression_brotli = 1;
#elif !HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG && HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE && !defined(OPENSSL_NO_BROTLI)
static constexpr int ts_has_cert_compression_brotli = 1;
#else
static constexpr int ts_has_cert_compression_brotli = 0;
#endif

#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG && HAVE_ZSTD_H
static constexpr int ts_has_cert_compression_zstd = 1;
#elif !HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG && HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE && !defined(OPENSSL_NO_ZSTD)
static constexpr int ts_has_cert_compression_zstd = 1;
#else
static constexpr int ts_has_cert_compression_zstd = 0;
#endif

static constexpr int ts_has_cert_compression =
ts_has_cert_compression_zlib | ts_has_cert_compression_brotli | ts_has_cert_compression_zstd;

// Produce output about compile time features, useful for checking how things were built
static void
print_feature(std::string_view name, int value, bool json, bool last = false)
Expand Down Expand Up @@ -100,11 +134,11 @@ produce_features(bool json)
#else
print_feature("TS_HAS_ZSTD", 0, json);
#endif
#if HAVE_SSL_CTX_ADD_CERT_COMPRESSION_ALG || HAVE_SSL_CTX_SET1_CERT_COMP_PREFERENCE
print_feature("TS_HAS_CERT_COMPRESSION", 1, json);
#else
print_feature("TS_HAS_CERT_COMPRESSION", 0, json);
#endif
print_feature("TS_HAS_CERT_COMPRESSION", ts_has_cert_compression, json);
print_feature("TS_HAS_CERT_COMPRESSION_CALLBACKS", ts_has_cert_compression_callbacks, json);
print_feature("TS_HAS_CERT_COMPRESSION_ZLIB", ts_has_cert_compression_zlib, json);
print_feature("TS_HAS_CERT_COMPRESSION_BROTLI", ts_has_cert_compression_brotli, json);
print_feature("TS_HAS_CERT_COMPRESSION_ZSTD", ts_has_cert_compression_zstd, json);
#ifdef F_GETPIPE_SZ
print_feature("TS_HAS_PIPE_BUFFER_SIZE_CONFIG", 1, json);
#else
Expand Down
2 changes: 1 addition & 1 deletion tests/gold_tests/tls/tls_cert_comp.test.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@
decompression succeed by checking the ssl cert compression metrics.
'''

Test.SkipUnless(Condition.HasATSFeature('TS_HAS_CERT_COMPRESSION'))
Test.SkipUnless(Condition.HasATSFeature('TS_HAS_CERT_COMPRESSION_CALLBACKS'))

REPLAY_FILE = 'replay/tls_cert_compression.replay.yaml'

Expand Down