[rpms/trafficserver] trafficserver-9.2.14-1: Backport fix for broken oubound TLS with OpenSSL 3.2+

[Jered Floyd <jered@redhat.com>]

A new commit has been pushed.

Repo   : rpms/trafficserver
Branch : trafficserver-9.2.14-1
Commit : 80f250a23b5c7c1f6a371a1d4f4131200d8eff06
Author : Jered Floyd <jered@redhat.com>
Date   : 2024-11-13T04:43:52+00:00
Stats  : +229/-1 in 2 file(s)
URL    : https://src.fedoraproject.org/rpms/trafficserver/c/80f250a23b5c7c1f6a371a1d4f4131200d8eff06?branch=trafficserver-9.2.14-1

Log:
Backport fix for broken oubound TLS with OpenSSL 3.2+

---
diff --git a/openssl-32-11501.patch b/openssl-32-11501.patch
new file mode 100644
index 0000000..7530766
--- /dev/null
+++ b/openssl-32-11501.patch
@@ -0,0 +1,221 @@
+--- iocore/net/BIO_fastopen.cc	2024-11-13 04:06:43.212364841 +0000
++++ iocore/net/BIO_fastopen.cc	2024-11-13 04:23:48.026728016 +0000
+@@ -21,12 +21,121 @@
+  *  limitations under the License.
+  */
+ 
++#include <openssl/opensslv.h>
++
+ #include "P_Net.h"
+ #include "I_SocketManager.h"
+ #include "tscore/ink_assert.h"
++#include "tscore/ink_config.h"
+ 
+ #include "BIO_fastopen.h"
+ 
++#if defined(BORINGLIKE)
++#error
++#elif defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_IS_AWSLC)
++#define BORINGLIKE 1
++#else
++#define BORINGLIKE 0
++#endif
++
++// Hack to test before updating autoconf
++#define HAVE_BIO_GET_EX_NEW_INDEX 1
++#define HAVE_BIO_GET_EX_DATA 1
++#define HAVE_BIO_SET_EX_DATA 1
++
++namespace
++{
++
++#if defined(HAVE_BIO_GET_EX_NEW_INDEX) && defined(HAVE_BIO_GET_EX_DATA) && defined(HAVE_BIO_SET_EX_DATA)
++
++class ExData
++{
++public:
++  // Pseudo-namespace
++  ExData() = delete;
++
++  static int
++  idx()
++  {
++    static int idx_ = []() -> int {
++      int i = BIO_get_ex_new_index(0, nullptr, _new, _dup, _free);
++      ink_release_assert(i >= 0);
++      return i;
++    }();
++    return idx_;
++  }
++
++private:
++#if BORINGLIKE
++  static constexpr CRYPTO_EX_unused *_new{nullptr};
++#else
++  static void
++  _new(void * /* parent */, void * /* ptr */, CRYPTO_EX_DATA *ad, int idx_, long /* argl */, void * /* argp */)
++  {
++    ink_release_assert(CRYPTO_set_ex_data(ad, idx_, nullptr) == 1);
++  }
++#endif
++
++#if BORINGLIKE
++  static void
++  _free(void * /* parent */, void * /* ptr */, CRYPTO_EX_DATA * /* ad */, int /* idx_ */, long /* argl */, void * /* argp */)
++  {
++  }
++#else
++  static void
++  _free(void * /* parent */, void * /* ptr */, CRYPTO_EX_DATA *ad, int idx_, long /* argl */, void * /* argp */)
++  {
++    ink_release_assert(CRYPTO_set_ex_data(ad, idx_, nullptr) == 1);
++  }
++#endif
++
++#if BORINGLIKE || (OPENSSL_VERSION_MAJOR >= 3)
++  using _Type_from_d = void **;
++#else
++  using _Type_from_d = void *;
++#endif
++
++  static int
++  _dup(CRYPTO_EX_DATA * /* to */, const CRYPTO_EX_DATA * /* from */, _Type_from_d /* from_d */, int /* idx */, long /* argl */,
++       void * /* argp */)
++  {
++    ink_assert(false);
++    return 0;
++  }
++};
++
++inline void
++set_dest_addr_for_bio(BIO *b, void *dest_addr)
++{
++  ink_assert(BIO_set_ex_data(b, ExData::idx(), dest_addr) == 1);
++}
++
++inline void *
++get_dest_addr_for_bio(BIO *b)
++{
++  return BIO_get_ex_data(b, ExData::idx());
++}
++
++#else // no BIO ex data in SSL library
++
++// Fall back on the krufty way this was done using older SSL libraries.
++
++inline void
++set_dest_addr_for_bio(BIO *b, void *dest_addr)
++{
++  BIO_set_data(b, dest_addr);
++}
++
++inline void *
++get_dest_addr_for_bio(BIO *b)
++{
++  return BIO_get_data(b);
++}
++
++#endif
++
++} // end anonymous namespace
++
+ // For BoringSSL, which for some reason doesn't have this function.
+ // (In BoringSSL, sock_read() and sock_write() use the internal
+ // bio_fd_non_fatal_error() instead.) #1437
+@@ -113,12 +222,13 @@
+   int fd = BIO_get_fd(bio, nullptr);
+   ink_assert(fd != NO_FD);
+ 
+-  if (BIO_get_data(bio)) {
++  void *dst_void = get_dest_addr_for_bio(bio);
++  if (dst_void) {
++    auto dst = static_cast<sockaddr *>(dst_void);
+     // On the first write only, make a TFO request if TFO is enabled.
+     // The best documentation on the behavior of the Linux API is in
+     // RFC 7413. If we get EINPROGRESS it means that the SYN has been
+     // sent without data and we should retry.
+-    const sockaddr *dst = reinterpret_cast<const sockaddr *>(BIO_get_data(bio));
+     ProxyMutex *mutex   = this_ethread()->mutex.get();
+ 
+     NET_INCREMENT_DYN_STAT(net_fastopen_attempts_stat);
+@@ -128,7 +238,7 @@
+       NET_INCREMENT_DYN_STAT(net_fastopen_successes_stat);
+     }
+ 
+-    BIO_set_data(bio, nullptr);
++    set_dest_addr_for_bio(bio, nullptr);
+   } else {
+     err = socketManager.write(fd, (void *)in, insz);
+   }
+@@ -166,21 +276,14 @@
+   return err < 0 ? -1 : err;
+ }
+ 
++#ifndef HAVE_BIO_METH_NEW
++
+ static long
+ fastopen_ctrl(BIO *bio, int cmd, long larg, void *ptr)
+ {
+-  switch (cmd) {
+-  case BIO_C_SET_CONNECT:
+-    // We only support BIO_set_conn_address(), which sets a sockaddr.
+-    ink_assert(larg == 2);
+-    BIO_set_data(bio, ptr);
+-    return 0;
+-  }
+-
+   return BIO_meth_get_ctrl(const_cast<BIO_METHOD *>(BIO_s_socket()))(bio, cmd, larg, ptr);
+ }
+ 
+-#ifndef HAVE_BIO_METH_NEW
+ static const BIO_METHOD fastopen_methods[] = {{
+   .type          = BIO_TYPE_SOCKET,
+   .name          = "fastopen",
+@@ -198,7 +301,7 @@
+   BIO_METHOD *methods = BIO_meth_new(BIO_TYPE_SOCKET, "fastopen");
+   BIO_meth_set_write(methods, fastopen_bwrite);
+   BIO_meth_set_read(methods, fastopen_bread);
+-  BIO_meth_set_ctrl(methods, fastopen_ctrl);
++  BIO_meth_set_ctrl(methods, BIO_meth_get_ctrl(const_cast<BIO_METHOD *>(BIO_s_socket())));
+   BIO_meth_set_create(methods, fastopen_create);
+   BIO_meth_set_destroy(methods, fastopen_destroy);
+   return methods;
+@@ -210,3 +313,9 @@
+ {
+   return fastopen_methods;
+ }
++
++void
++BIO_fastopen_set_dest_addr(BIO *bio, const sockaddr *dest_addr)
++{
++  set_dest_addr_for_bio(bio, const_cast<sockaddr *>(dest_addr));
++}
+--- iocore/net/BIO_fastopen.h	2024-11-13 04:04:33.300174283 +0000
++++ iocore/net/BIO_fastopen.h	2024-11-13 04:05:24.663643535 +0000
+@@ -28,8 +28,5 @@
+ // Return a BIO_METHOD for a socket BIO that implements TCP Fast Open.
+ const BIO_METHOD *BIO_s_fastopen();
+ 
+-// OpenSSL 1.0.2h has BIO_set_conn_ip(), but master has BIO_set_conn_address(). Use
+-// the API from master since it makes more sense.
+-#if !defined(BIO_set_conn_address)
+-#define BIO_set_conn_address(b, addr) BIO_ctrl(b, BIO_C_SET_CONNECT, 2, (char *)addr)
+-#endif
++// Set destination address for a BIO for a fastopen TCP socket where the local host is the client.
++void BIO_fastopen_set_dest_addr(BIO *bio, const sockaddr *dest_addr);
+--- iocore/net/SSLNetVConnection.cc	2024-11-13 04:03:11.781428279 +0000
++++ iocore/net/SSLNetVConnection.cc	2024-11-13 04:03:56.681839737 +0000
+@@ -162,10 +162,9 @@
+       BIO *bio = BIO_new(const_cast<BIO_METHOD *>(BIO_s_fastopen()));
+       BIO_set_fd(bio, this->get_socket(), BIO_NOCLOSE);
+ 
+-      if (this->options.f_tcp_fastopen) {
+-        BIO_set_conn_address(bio, this->get_remote_addr());
+-      }
+-
++      BIO_fastopen_set_dest_addr(bio,
++                                 this->options.f_tcp_fastopen ? this->get_remote_addr() : static_cast<const sockaddr *>(nullptr));
++ 
+       SSL_set_bio(ssl, bio, bio);
+     } else {
+       this->initialize_handshake_buffers();

diff --git a/trafficserver.spec b/trafficserver.spec
index 5e3d911..12b8571 100644
--- a/trafficserver.spec
+++ b/trafficserver.spec
@@ -4,7 +4,7 @@
 
 Name:           trafficserver
 Version:        9.2.6
-Release:        1%{?dist}
+Release:        2%{?dist}
 Summary:        Fast, scalable and extensible HTTP/1.1 and HTTP/2 caching proxy server
 
 # Automatically converted from old format: ASL 2.0 - review is highly recommended.
@@ -26,6 +26,10 @@ Source9:        %{modulename}.fc
 Patch0:         trafficserver-crypto-policy.patch
 %endif
 
+# Fix outbound TLS connectios with OpenSSL 3.2+
+# Upstream: https://github.com/apache/trafficserver/pull/11501
+Patch1:         openssl-32-11501.patch
+
 # Upstream does not support 32-bit architectures:
 # https://github.com/apache/trafficserver/issues/4432
 # s390x is also not a supported architecture and does not build
@@ -309,6 +313,9 @@ fi
 
 
 %changelog
+* Tue Nov 12 2024 Jered Floyd <jered@redhat.com> 9.2.6-2
+- Backport fix for broken oubound TLS with OpenSSL 3.2+
+
 * Tue Nov 12 2024 Jered Floyd <jered@redhat.com> 9.2.6-1
 - Update to upstream 9.2.6