MINOR: ssl: support curve fetches with AWS-LC API 30

Enable ssl_fc_curve and ssl_bc_curve with AWS-LC API 30-34, including
AWS-LC 3.0.0, using SSL_get_group_id() and SSL_get_group_name() instead
of SSL_get_negotiated_group(), which requires API 35.

Map NIST curve group IDs to OpenSSL short names to keep the output
consistent with newer AWS-LC versions. Preserve native names for other
groups, including post-quantum and hybrid groups.

Update the compatibility documentation and enable the curve regression
tests for AWS-LC API 30.

diff --git a/doc/configuration.txt b/doc/configuration.txt
index b6eac57f93af78c18081858833d3ba753df35e29..514bbd67f8a73e9c0d497407c5cca2ada433ad2a 100644 (file)
--- a/doc/configuration.txt
+++ b/doc/configuration.txt
@@ -26755,8 +26755,13 @@ ssl_bc_client_traffic_secret_0 : string
 
 ssl_bc_curve : string
   Returns the name of the curve used in the key agreement when the outgoing
-  connection was made over an SSL/TLS transport layer. This requires
-  OpenSSL >= 3.0.0 or AWS-LC >= 1.57.0.
+  connection was made over an SSL/TLS transport layer.
+
+  The output format depends on the HAProxy and SSL library versions. The name
+  may use NIST notation (e.g. "P-256"), OpenSSL notation (e.g. "prime256v1"),
+  or another library-specific format. Spelling and case may also vary.
+
+  Compatibility: OpenSSL >= 3.0.0, AWS-LC >= 3.0.0 (API >= 30).
 
 ssl_bc_early_exporter_secret : string
   Return the EARLY_EXPORTER_SECRET as an hexadecimal string for the
@@ -27237,8 +27242,13 @@ ssl_fc_crtname : string
 
 ssl_fc_curve : string
   Returns the name of the curve used in the key agreement when the incoming
-  connection was made over an SSL/TLS transport layer. This requires
-  OpenSSL >= 3.0.0.
+  connection was made over an SSL/TLS transport layer.
+
+  The output format depends on the HAProxy and SSL library versions. The name
+  may use NIST notation (e.g. "P-256"), OpenSSL notation (e.g. "prime256v1"),
+  or another library-specific format. Spelling and case may also vary.
+
+  Compatibility: OpenSSL >= 3.0.0, AWS-LC >= 3.0.0 (API >= 30).
 
 ssl_fc_early_rcvd : boolean
   Returns true if early data were seen over that connection, regardless of the

diff --git a/reg-tests/quic/ssl_curve_name.vtc b/reg-tests/quic/ssl_curve_name.vtc
index 1d226e8729814ae9d5f840678b5eb97fd799f23b..6d01b3d2321bdf4eb3231bc9d991cd6738a7516f 100644 (file)
--- a/reg-tests/quic/ssl_curve_name.vtc
+++ b/reg-tests/quic/ssl_curve_name.vtc
@@ -1,7 +1,7 @@
 #REGTEST_TYPE=devel
 
 varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches"
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
 feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'"
 
 

diff --git a/reg-tests/quic/ssl_curves_selection.vtc b/reg-tests/quic/ssl_curves_selection.vtc
index d831f730b8050caaf609386b1fd24dde92641b1d..4dc00731c44b3b0ba6167ba23fc719f3b964cca1 100644 (file)
--- a/reg-tests/quic/ssl_curves_selection.vtc
+++ b/reg-tests/quic/ssl_curves_selection.vtc
@@ -11,7 +11,7 @@
 
 varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends"
 
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
 
 setenv VTC_SOCK_TYPE quic
 include ${testdir}/../ssl/ssl_curves_selection.vtci

diff --git a/reg-tests/ssl/ssl_curve_name.vtc b/reg-tests/ssl/ssl_curve_name.vtc
index 87ff8413f4b6c3b47330e96fab7bb2c0ec232712..f73c340e83db684da8ab178348ebaf697571b5d5 100644 (file)
--- a/reg-tests/ssl/ssl_curve_name.vtc
+++ b/reg-tests/ssl/ssl_curve_name.vtc
@@ -1,7 +1,7 @@
 #REGTEST_TYPE=devel
 
 varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches"
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_curve_name.vtci

diff --git a/reg-tests/ssl/ssl_curves_selection.vtc b/reg-tests/ssl/ssl_curves_selection.vtc
index ad38f12de7db0bd022a9ea43a4bf33d0b44b689e..f379ebc92fb40f5aafbe6e8e7011af4d39aea91e 100644 (file)
--- a/reg-tests/ssl/ssl_curves_selection.vtc
+++ b/reg-tests/ssl/ssl_curves_selection.vtc
@@ -10,7 +10,7 @@
 
 varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends"
 
-feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'"
+feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'"
 
 setenv VTC_SOCK_TYPE stream
 include ${testdir}/ssl_curves_selection.vtci

diff --git a/src/ssl_sample.c b/src/ssl_sample.c
index 2725b67ebb762969ee39867862663128461f071a..2a2180e624ceca75e895a83d4306294e523125da 100644 (file)
--- a/src/ssl_sample.c
+++ b/src/ssl_sample.c
@@ -1726,10 +1726,10 @@ smp_fetch_ssl_fc_is_resumed(const struct arg *args, struct sample *smp, const ch
  * string, returns the EC curve used for key agreement on the
  * front and backend connection.
  *
- * The function to get the curve name (SSL_get_negotiated_group) is only available
- * in OpenSSLv3 onwards and not for previous versions, and in AWS-LC >= 1.57.0.
+ * SSL_get_negotiated_group is available in OpenSSL >= 3.0 and AWS-LC API >= 35.
+ * AWS-LC API 30-34 (including 3.0.0) provides SSL_get_group_id/name instead.
  */
-#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 35)
+#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 30)
 static int
 smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw, void *private)
 {
@@ -1770,6 +1770,26 @@ smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw,
                for (i = 0; curve_name[i]; i++)
                        curve_name[i] = toupper((unsigned char)curve_name[i]);
        }
+# elif defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION < 35
+       uint16_t group = SSL_get_group_id(ssl);
+
+       /* Match the NIST curve short names returned by the NID-based API in
+        * newer AWS-LC versions. Other groups, including PQ/hybrid groups,
+        * retain their native names. TLS group IDs are not OpenSSL NIDs.
+        */
+       switch (group) {
+               case SSL_GROUP_SECP224R1: nid = NID_secp224r1;        break;
+               case SSL_GROUP_SECP256R1: nid = NID_X9_62_prime256v1; break;
+               case SSL_GROUP_SECP384R1: nid = NID_secp384r1;        break;
+               case SSL_GROUP_SECP521R1: nid = NID_secp521r1;        break;
+               default:                  nid = NID_undef;            break;
+       }
+       if (nid != NID_undef)
+               curve_name = (char *)OBJ_nid2sn(nid);
+       else
+               curve_name = (char *)SSL_get_group_name(group);
+       if (!curve_name)
+               return 0;
 # else
        nid = SSL_get_negotiated_group(ssl);
        if (!nid)
@@ -2808,7 +2828,7 @@ static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
        { "ssl_bc_alpn",            smp_fetch_ssl_fc_alpn,        0,                   NULL,    SMP_T_STR,  SMP_USE_L5SRV },
 #endif
        { "ssl_bc_cipher",          smp_fetch_ssl_fc_cipher,      0,                   NULL,    SMP_T_STR,  SMP_USE_L5SRV },
-#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 35)
+#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 30)
         { "ssl_bc_curve",           smp_fetch_ssl_fc_ec,          0,                   NULL,    SMP_T_STR,  SMP_USE_L5SRV },
 #endif
 #if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG)
@@ -2874,7 +2894,7 @@ static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, {
        { "ssl_fc",                 smp_fetch_ssl_fc,             0,                   NULL,    SMP_T_BOOL, SMP_USE_L5CLI },
        { "ssl_fc_alg_keysize",     smp_fetch_ssl_fc_alg_keysize, 0,                   NULL,    SMP_T_SINT, SMP_USE_L5CLI },
        { "ssl_fc_cipher",          smp_fetch_ssl_fc_cipher,      0,                   NULL,    SMP_T_STR,  SMP_USE_L5CLI },
-#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 35)
+#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 30)
         { "ssl_fc_curve",           smp_fetch_ssl_fc_ec,          0,                   NULL,    SMP_T_STR,  SMP_USE_L5CLI },
 #endif
        { "ssl_fc_early_rcvd",      smp_fetch_ssl_fc_early_rcvd,  0,                   NULL,    SMP_T_BOOL, SMP_USE_L5CLI },