From: William Lallemand Date: Mon, 5 Oct 2026 12:45:35 +0000 (+0200) Subject: MINOR: ssl: support curve fetches with AWS-LC API 30 X-Git-Tag: v3.5-dev9~204 X-Git-Url: https://git.kaiwu.me/$%7BGITURL%7D$%7Bcid%7D?a=commitdiff_plain;h=e671cb696dc569892d5ea2de38cab479d4935543;p=haproxy.git MINOR: ssl: support curve fetches with AWS-LC API 30 Enable ssl_fc_curve and ssl_bc_curve with AWS-LC API 30-34, including AWS-LC 3.0.0, using SSL_get_group_id() and SSL_get_group_name() instead of SSL_get_negotiated_group(), which requires API 35. Map NIST curve group IDs to OpenSSL short names to keep the output consistent with newer AWS-LC versions. Preserve native names for other groups, including post-quantum and hybrid groups. Update the compatibility documentation and enable the curve regression tests for AWS-LC API 30. --- diff --git a/doc/configuration.txt b/doc/configuration.txt index b6eac57f9..514bbd67f 100644 --- a/doc/configuration.txt +++ b/doc/configuration.txt @@ -26755,8 +26755,13 @@ ssl_bc_client_traffic_secret_0 : string ssl_bc_curve : string Returns the name of the curve used in the key agreement when the outgoing - connection was made over an SSL/TLS transport layer. This requires - OpenSSL >= 3.0.0 or AWS-LC >= 1.57.0. + connection was made over an SSL/TLS transport layer. + + The output format depends on the HAProxy and SSL library versions. The name + may use NIST notation (e.g. "P-256"), OpenSSL notation (e.g. "prime256v1"), + or another library-specific format. Spelling and case may also vary. + + Compatibility: OpenSSL >= 3.0.0, AWS-LC >= 3.0.0 (API >= 30). ssl_bc_early_exporter_secret : string Return the EARLY_EXPORTER_SECRET as an hexadecimal string for the @@ -27237,8 +27242,13 @@ ssl_fc_crtname : string ssl_fc_curve : string Returns the name of the curve used in the key agreement when the incoming - connection was made over an SSL/TLS transport layer. This requires - OpenSSL >= 3.0.0. + connection was made over an SSL/TLS transport layer. + + The output format depends on the HAProxy and SSL library versions. The name + may use NIST notation (e.g. "P-256"), OpenSSL notation (e.g. "prime256v1"), + or another library-specific format. Spelling and case may also vary. + + Compatibility: OpenSSL >= 3.0.0, AWS-LC >= 3.0.0 (API >= 30). ssl_fc_early_rcvd : boolean Returns true if early data were seen over that connection, regardless of the diff --git a/reg-tests/quic/ssl_curve_name.vtc b/reg-tests/quic/ssl_curve_name.vtc index 1d226e872..6d01b3d23 100644 --- a/reg-tests/quic/ssl_curve_name.vtc +++ b/reg-tests/quic/ssl_curve_name.vtc @@ -1,7 +1,7 @@ #REGTEST_TYPE=devel varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches" -feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'" feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && !feature(QUIC_OPENSSL_COMPAT) && !feature(OPENSSL_WOLFSSL)'" diff --git a/reg-tests/quic/ssl_curves_selection.vtc b/reg-tests/quic/ssl_curves_selection.vtc index d831f730b..4dc00731c 100644 --- a/reg-tests/quic/ssl_curves_selection.vtc +++ b/reg-tests/quic/ssl_curves_selection.vtc @@ -11,7 +11,7 @@ varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends" -feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(QUIC) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(QUIC) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'" setenv VTC_SOCK_TYPE quic include ${testdir}/../ssl/ssl_curves_selection.vtci diff --git a/reg-tests/ssl/ssl_curve_name.vtc b/reg-tests/ssl/ssl_curve_name.vtc index 87ff8413f..f73c340e8 100644 --- a/reg-tests/ssl/ssl_curve_name.vtc +++ b/reg-tests/ssl/ssl_curve_name.vtc @@ -1,7 +1,7 @@ #REGTEST_TYPE=devel varnishtest "Test the ssl_fc_curve/ssl_bc_curve sample fetches" -feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'" setenv VTC_SOCK_TYPE stream include ${testdir}/ssl_curve_name.vtci diff --git a/reg-tests/ssl/ssl_curves_selection.vtc b/reg-tests/ssl/ssl_curves_selection.vtc index ad38f12de..f379ebc92 100644 --- a/reg-tests/ssl/ssl_curves_selection.vtc +++ b/reg-tests/ssl/ssl_curves_selection.vtc @@ -10,7 +10,7 @@ varnishtest "Tests for ssl-default-{bind,server}-curves global option and curves option for backends/frontends" -feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(35)'" +feature cmd "$HAPROXY_PROGRAM -cc 'feature(OPENSSL) && ssllib_name_startswith(OpenSSL) && openssl_version_atleast(3.0.0) || feature(OPENSSL) && ssllib_name_startswith(AWS-LC) && awslc_api_atleast(30)'" setenv VTC_SOCK_TYPE stream include ${testdir}/ssl_curves_selection.vtci diff --git a/src/ssl_sample.c b/src/ssl_sample.c index 2725b67eb..2a2180e62 100644 --- a/src/ssl_sample.c +++ b/src/ssl_sample.c @@ -1726,10 +1726,10 @@ smp_fetch_ssl_fc_is_resumed(const struct arg *args, struct sample *smp, const ch * string, returns the EC curve used for key agreement on the * front and backend connection. * - * The function to get the curve name (SSL_get_negotiated_group) is only available - * in OpenSSLv3 onwards and not for previous versions, and in AWS-LC >= 1.57.0. + * SSL_get_negotiated_group is available in OpenSSL >= 3.0 and AWS-LC API >= 35. + * AWS-LC API 30-34 (including 3.0.0) provides SSL_get_group_id/name instead. */ -#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 35) +#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 30) static int smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw, void *private) { @@ -1770,6 +1770,26 @@ smp_fetch_ssl_fc_ec(const struct arg *args, struct sample *smp, const char *kw, for (i = 0; curve_name[i]; i++) curve_name[i] = toupper((unsigned char)curve_name[i]); } +# elif defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION < 35 + uint16_t group = SSL_get_group_id(ssl); + + /* Match the NIST curve short names returned by the NID-based API in + * newer AWS-LC versions. Other groups, including PQ/hybrid groups, + * retain their native names. TLS group IDs are not OpenSSL NIDs. + */ + switch (group) { + case SSL_GROUP_SECP224R1: nid = NID_secp224r1; break; + case SSL_GROUP_SECP256R1: nid = NID_X9_62_prime256v1; break; + case SSL_GROUP_SECP384R1: nid = NID_secp384r1; break; + case SSL_GROUP_SECP521R1: nid = NID_secp521r1; break; + default: nid = NID_undef; break; + } + if (nid != NID_undef) + curve_name = (char *)OBJ_nid2sn(nid); + else + curve_name = (char *)SSL_get_group_name(group); + if (!curve_name) + return 0; # else nid = SSL_get_negotiated_group(ssl); if (!nid) @@ -2808,7 +2828,7 @@ static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, { { "ssl_bc_alpn", smp_fetch_ssl_fc_alpn, 0, NULL, SMP_T_STR, SMP_USE_L5SRV }, #endif { "ssl_bc_cipher", smp_fetch_ssl_fc_cipher, 0, NULL, SMP_T_STR, SMP_USE_L5SRV }, -#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 35) +#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 30) { "ssl_bc_curve", smp_fetch_ssl_fc_ec, 0, NULL, SMP_T_STR, SMP_USE_L5SRV }, #endif #if defined(OPENSSL_NPN_NEGOTIATED) && !defined(OPENSSL_NO_NEXTPROTONEG) @@ -2874,7 +2894,7 @@ static struct sample_fetch_kw_list sample_fetch_keywords = {ILH, { { "ssl_fc", smp_fetch_ssl_fc, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI }, { "ssl_fc_alg_keysize", smp_fetch_ssl_fc_alg_keysize, 0, NULL, SMP_T_SINT, SMP_USE_L5CLI }, { "ssl_fc_cipher", smp_fetch_ssl_fc_cipher, 0, NULL, SMP_T_STR, SMP_USE_L5CLI }, -#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 35) +#if (HA_OPENSSL_VERSION_NUMBER >= 0x3000000fL) || (defined(OPENSSL_IS_AWSLC) && AWSLC_API_VERSION >= 30) { "ssl_fc_curve", smp_fetch_ssl_fc_ec, 0, NULL, SMP_T_STR, SMP_USE_L5CLI }, #endif { "ssl_fc_early_rcvd", smp_fetch_ssl_fc_early_rcvd, 0, NULL, SMP_T_BOOL, SMP_USE_L5CLI },