1948976 – rust: Port to OpenSSL 3.0

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1948976 - rust: Port to OpenSSL 3.0

Summary: rust: Port to OpenSSL 3.0

Keywords:
Status:	CLOSED CURRENTRELEASE
Alias:	None
Product:	Red Hat Enterprise Linux 9
Classification:	Red Hat
Component:	rust
Sub Component:
Version:	CentOS Stream
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	beta
Target Release:	---
Assignee:	Josh Stone
QA Contact:	Alexandra Petlanová Hájková
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:	1958021
TreeView+	depends on / blocked

Reported:	2021-04-13 07:52 UTC by Florian Weimer
Modified:	2021-12-07 21:55 UTC (History)
CC List:	5 users (show)
Fixed In Version:	rust-1.52.1-3.el9
Doc Type:	No Doc Update
Doc Text:
Clone Of:
Environment:
Last Closed:	2021-12-07 21:52:33 UTC
Type:	Bug
Target Upstream Version:
Embargoed:
Dependent Products:

Attachments	(Terms of Use)

Links
System	ID	Priority	Status	Summary	Last Updated
Github	rust-lang rust pull 86529	None	open	Add support for OpenSSL 3.0.0	2021-06-23 16:47:31 UTC
Github	sfackler rust-openssl issues 1263	None	closed	Support OpenSSL 3.0.0	2021-06-23 16:46:10 UTC
Github	sfackler rust-openssl pull 1264	None	closed	Initial support for OpenSSL 3.0.0-alpha17	2021-06-23 16:46:11 UTC

Internal Links: 1964825

Description Florian Weimer 2021-04-13 07:52:57 UTC

Building with openssl-devel from OpenSSL 3.0 fails:

The following warnings were emitted during compilation:
warning: build/expando.c:4:24: error: pasting "RUST_VERSION_OPENSSL_" and "(" does not give a valid preprocessing token
warning:     4 | #define VERSION2(n, v) RUST_VERSION_##n##_##v
warning:       |                        ^~~~~~~~~~~~~
warning: build/expando.c:5:23: note: in expansion of macro ‘VERSION2’
warning:     5 | #define VERSION(n, v) VERSION2(n, v)
warning:       |                       ^~~~~~~~
warning: build/expando.c:10:1: note: in expansion of macro ‘VERSION’
warning:    10 | VERSION(OPENSSL, OPENSSL_VERSION_NUMBER)
warning:       | ^~~~~~~
error: failed to run custom build command for `openssl-sys v0.9.58`
Caused by:
  process didn't exit successfully: `/builddir/build/BUILD/rustc-1.49.0-src/build/i686-unknown-linux-gnu/stage2-tools/release/build/openssl-sys-89b8c7c3d28ae09c/build-script-main` (exit code: 101)
  --- stdout
  cargo:rustc-cfg=const_fn
  cargo:rerun-if-env-changed=I686_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR
  I686_UNKNOWN_LINUX_GNU_OPENSSL_LIB_DIR unset
  cargo:rerun-if-env-changed=OPENSSL_LIB_DIR
  OPENSSL_LIB_DIR unset
  cargo:rerun-if-env-changed=I686_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR
  I686_UNKNOWN_LINUX_GNU_OPENSSL_INCLUDE_DIR unset
  cargo:rerun-if-env-changed=OPENSSL_INCLUDE_DIR
  OPENSSL_INCLUDE_DIR unset
  cargo:rerun-if-env-changed=I686_UNKNOWN_LINUX_GNU_OPENSSL_DIR
  I686_UNKNOWN_LINUX_GNU_OPENSSL_DIR unset
  cargo:rerun-if-env-changed=OPENSSL_DIR
  OPENSSL_DIR unset
  cargo:rerun-if-env-changed=OPENSSL_NO_PKG_CONFIG
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=OPENSSL_STATIC
  cargo:rerun-if-env-changed=OPENSSL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_i686-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_i686_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_i686-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_i686_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_i686-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_i686_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=OPENSSL_STATIC
  cargo:rerun-if-env-changed=OPENSSL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rustc-link-lib=ssl
  cargo:rustc-link-lib=crypto
  cargo:rerun-if-env-changed=PKG_CONFIG
  cargo:rerun-if-env-changed=OPENSSL_STATIC
  cargo:rerun-if-env-changed=OPENSSL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_STATIC
  cargo:rerun-if-env-changed=PKG_CONFIG_ALL_DYNAMIC
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_i686-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH_i686_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_PATH
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_i686-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR_i686_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_LIBDIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_i686-unknown-linux-gnu
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR_i686_unknown_linux_gnu
  cargo:rerun-if-env-changed=HOST_PKG_CONFIG_SYSROOT_DIR
  cargo:rerun-if-env-changed=PKG_CONFIG_SYSROOT_DIR
  OPT_LEVEL = Some("3")
  TARGET = Some("i686-unknown-linux-gnu")
  HOST = Some("i686-unknown-linux-gnu")
  CC_i686-unknown-linux-gnu = Some("gcc")
  CFLAGS_i686-unknown-linux-gnu = Some("-ffunction-sections -fdata-sections -fPIC -m32 -march=i686 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1 -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection")
  CRATE_CC_NO_DEFAULTS = None
  DEBUG = Some("false")
  CARGO_CFG_TARGET_FEATURE = Some("fxsr,sse,sse2")
  running: "gcc" "-O3" "-ffunction-sections" "-fdata-sections" "-fPIC" "-m32" "-march=i686" "-ffunction-sections" "-fdata-sections" "-fPIC" "-m32" "-march=i686" "-flto=auto" "-ffat-lto-objects" "-fexceptions" "-g" "-grecord-gcc-switches" "-pipe" "-Wall" "-Werror=format-security" "-Wp,-D_FORTIFY_SOURCE=2" "-Wp,-D_GLIBCXX_ASSERTIONS" "-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1" "-fstack-protector-strong" "-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1" "-m32" "-march=i686" "-mtune=generic" "-msse2" "-mfpmath=sse" "-mstackrealign" "-fasynchronous-unwind-tables" "-fstack-clash-protection" "-fcf-protection" "-I" "/usr/include" "-E" "build/expando.c"
  cargo:warning=build/expando.c:4:24: error: pasting "RUST_VERSION_OPENSSL_" and "(" does not give a valid preprocessing token
  cargo:warning=    4 | #define VERSION2(n, v) RUST_VERSION_##n##_##v
  cargo:warning=      |                        ^~~~~~~~~~~~~
  cargo:warning=build/expando.c:5:23: note: in expansion of macro ‘VERSION2’
  cargo:warning=    5 | #define VERSION(n, v) VERSION2(n, v)
  cargo:warning=      |                       ^~~~~~~~
  cargo:warning=build/expando.c:10:1: note: in expansion of macro ‘VERSION’
  cargo:warning=   10 | VERSION(OPENSSL, OPENSSL_VERSION_NUMBER)
  cargo:warning=      | ^~~~~~~
  exit code: 1
  --- stderr
  thread 'main' panicked at '
  Header expansion error:
  Error { kind: ToolExecError, message: "Command \"gcc\" \"-O3\" \"-ffunction-sections\" \"-fdata-sections\" \"-fPIC\" \"-m32\" \"-march=i686\" \"-ffunction-sections\" \"-fdata-sections\" \"-fPIC\" \"-m32\" \"-march=i686\" \"-flto=auto\" \"-ffat-lto-objects\" \"-fexceptions\" \"-g\" \"-grecord-gcc-switches\" \"-pipe\" \"-Wall\" \"-Werror=format-security\" \"-Wp,-D_FORTIFY_SOURCE=2\" \"-Wp,-D_GLIBCXX_ASSERTIONS\" \"-specs=/usr/lib/rpm/redhat/redhat-hardened-cc1\" \"-fstack-protector-strong\" \"-specs=/usr/lib/rpm/redhat/redhat-annobin-cc1\" \"-m32\" \"-march=i686\" \"-mtune=generic\" \"-msse2\" \"-mfpmath=sse\" \"-mstackrealign\" \"-fasynchronous-unwind-tables\" \"-fstack-clash-protection\" \"-fcf-protection\" \"-I\" \"/usr/include\" \"-E\" \"build/expando.c\" with args \"gcc\" did not execute successfully (status code exit code: 1)." }
  Failed to find OpenSSL development headers.
  You can try fixing this setting the `OPENSSL_DIR` environment variable
  pointing to your OpenSSL installation or installing OpenSSL headers package
  specific to your distribution:
      # On Ubuntu
      sudo apt-get install libssl-dev
      # On Arch Linux
      sudo pacman -S openssl
      # On Fedora
      sudo dnf install openssl-devel
  See rust-openssl README for more information:
      https://github.com/sfackler/rust-openssl#linux
  ', /builddir/build/BUILD/rustc-1.49.0-src/vendor/openssl-sys/build/main.rs:140:13
  note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

Comment 1 Florian Weimer 2021-04-13 07:57:09 UTC

Apparently openssl-sys has a separate branch: https://github.com/sfackler/rust-openssl/tree/openssl-300

It seems to me that openssl-sys replicates many C constructs in rust sources, e.g.:

pub const EVP_PKEY_CTRL_RSA_PADDING: c_int = EVP_PKEY_ALG_CTRL + 1;
pub const EVP_PKEY_CTRL_RSA_PSS_SALTLEN: c_int = EVP_PKEY_ALG_CTRL + 2;

pub const EVP_PKEY_CTRL_RSA_MGF1_MD: c_int = EVP_PKEY_ALG_CTRL + 5;

pub const EVP_PKEY_CTRL_GET_RSA_PADDING: c_int = EVP_PKEY_ALG_CTRL + 6;

I any of these constants have changed on the OpenSSL side, a silent incompatibility will be the result.

Comment 2 Josh Stone 2021-04-13 16:00:34 UTC

Florian, the systest/ crate in the repo is meant to catch such things in upstream CI.

Comment 4 Josh Stone 2021-05-14 21:01:16 UTC

The "fixed in version" build was still built with the old openssl-devel, but it include the compatibility changes in the Rust crates.

Here is a successful scratch build targeting c9s-build-ssl3:
https://kojihub.stream.centos.org/koji/taskinfo?taskID=266651

Comment 8 Alexandra Petlanová Hájková 2021-05-21 14:46:50 UTC

rust-1.52.1-1.el9 builds successfully on all the relavant architectures: https://kojihub.stream.centos.org/koji/taskinfo?taskID=266651

Comment 10 Colin Walters 2021-05-26 17:01:57 UTC

Hi Josh (or anyone who knows more about rust+openssl), mind commenting on:
https://bugzilla.redhat.com/show_bug.cgi?id=1964825#c5
Thanks!

Comment 11 Josh Stone 2021-06-23 16:45:42 UTC

FYI, the upstream rust-openssl changes have been merged and published.
I also submitted an upstream pull request to update the dependencies in rust itself.

Note You need to log in before you can comment on or make changes to this bug.