Add configs for groups list

[masaori335]

Fix #3604. This needs #4039 to work correctly.

Add new configs for supported groups

proxy.config.ssl.server.groups_list
proxy.config.ssl.client.groups_list

[zwoop]

Is there any other ifdef or detection we can use? Or do we know that this will be for OpenSSL only, and never BroimgSSL etc?

[masaori335]

Another choice is adding macros to detect this API in /build/crypto.m4. Do you prefer that?

BoringSSL has this macro and it indicates API compatibility.

BoringSSL's OPENSSL_VERSION_NUMBER matches the OpenSSL version it targets. Version checks for OpenSSL should ideally work as-is in BoringSSL

[maskit]

ifdef SSL_CTX_set1_groups_list ?

[SolidWallOfCode]

If you're willing to do a bit of meta programming, I have a header file with which you could do this

namespace
{
template <typename T>
auto
TS_SSL_CTX_set1_groups_list(T *, char *, ts::meta::CaseArg_0) -> bool
{
  return true;
}

template <typename T>
auto
TS_SSL_CTX_set1_groups_list(T *ctx, char *groups, ts::meta::CaseArg_1)
  -> decltype(SSL_CTX_set1_groups_list(static_cast<T *>(nullptr), static_cast<char*>(nullptr)), bool())
{
  if (!SSL_CTX_set1_groups_list(ctx, groups)) {
    SSLError("invalid groups list for client in records.config");
    return false;
  }
  return true;
}
} // namespace

bool
TS_SSL_CTX_set1_groups_list(SSL_CTX *ctx, char *params)
{
  return TS_SSL_CTX_set1_groups_list(ctx, params, ts::meta::CaseArg);
}

At the original call site, it's

  if (params->client_groups_list != nullptr) {
    if (!TS_SSL_CTX_set1_groups_list(client_ctx, params->client_groups_list)) {
      SSLError("invalid groups list for client in records.config");
      goto fail;
    }
  }

This doesn't depend on any #define or checking in configure.ac, it's completely self contained. It doesn't depend on knowing the openSSL version, and should work on BoringSSL. In fact, if BoringSSL has a functionally equivalent but differently named function, that could be easily incorporated.

[masaori335]

Interesting! Could you open a new PR to add the magic header file? It looks we should discuss ifdef v.s. meta programing for checking existence of libraries APIs. Because we have bunch of checks like this.

[masaori335]

Pushed new commit using SSL_CTX_set1_groups_list to detect itself.

[bryancall]

There is a typo on this line "lsit"

[bryancall]

Please add a link to the openssl documentation.

[masaori335]

Do you mean man page of SSL_CTX_set1_groups_list ?
https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set1_groups_list.html

or more general description?
https://wiki.openssl.org/index.php/TLS1.3#Groups

[masaori335]

Fixed typo and added links of OpenSSL.