vacp2p/nim-ngtcp2
1
0
Fork 0
mirror of https://github.com/vacp2p/nim-ngtcp2.git synced 2026-01-08 20:48:03 -05:00
Code Issues Packages Projects Releases 4 Wiki Activity

feat: replace picotls by aws-lc

Browse Source
This commit is contained in:
Richard Ramos
2025-10-07 10:24:03 -04:00
parent 14adc588ba
commit 723a561388
17 changed files with 76368 additions and 6461 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.gitmodules vendored
View File

@@ -1,6 +1,6 @@
[submodule "libs/ngtcp2"]
path = libs/ngtcp2
url = https://github.com/ngtcp2/ngtcp2
[submodule "libs/picotls"]
path = libs/picotls
url = https://github.com/h2o/picotls
[submodule "libs/aws-lc"]
path = libs/aws-lc
url = https://github.com/aws/aws-lc

19
build.sh
View File

@@ -6,25 +6,26 @@ rm -f ngtcp2.nim
# assemble list of C files to be compiled
toCompile=(
"${sources}/picotls/picotlsvs/picotls/wintimeofday.c"
"${sources}/picotls/lib/pembase64.c"
"${sources}/picotls/lib/hpke.c"
"${sources}/picotls/lib/picotls.c"
"${sources}/picotls/lib/openssl.c"
# "${sources}/path/to/file.c"
)
for file in `ls "${sources}/ngtcp2/crypto"/*.c`; do
toCompile+=("$file")
done
for file in `ls "${sources}/ngtcp2/crypto/picotls"/*.c`; do
for file in `ls "${sources}/ngtcp2/crypto/boringssl"/*.c`; do
toCompile+=("$file")
done
for file in `ls "${sources}/ngtcp2/lib"/*.c`; do
toCompile+=("$file")
done
for file in `ls "${root}/build/lib"/*.c`; do
toCompile+=("$file")
done
# build aws-lc
# TODO: look into building this without requiring CMAKE
tmpdir=$(mktemp -d)
cmake -S ./libs/aws-lc -B "$tmpdir" -DCMAKE_BUILD_TYPE=Release -DBUILD_SHARED_LIBS=OFF -DBUILD_TESTING=OFF -DBUILD_TOOL=OFF -DDISABLE_PERL=ON -DDISABLE_GO=ON -DOPENSSL_NO_ASM=ON
cmake --build "$tmpdir" --target all
cp "$tmpdir"/ssl/libssl.a ./build/.
cp "$tmpdir"/crypto/libcrypto.a ./build/.
# futhark is required by generate_ngtcp2.nim
nimble install futhark@0.15.0

140
build/lib/cred_buffer.c
View File

@@ -1,140 +0,0 @@
#include <stddef.h>
#include <string.h>
#include <stdio.h>
#include <stdlib.h>
#include "utils/cred_buffer.h"
#define MIN(a, b) ((a) < (b) ? (a) : (b))
static int cred_buffer_getc(ptls_cred_buffer_t *buf)
{
return PTLS_CRED_BUFFER_LEFT(buf) > 0 ? buf->base[buf->off++] : -1;
}
static ssize_t fsize(FILE *fp)
{
long sz;
if (fseek(fp, 0, SEEK_END) == -1 || (sz = ftell(fp)) == -1) {
return -1;
}
rewind(fp);
return (ssize_t) sz;
}
/* The caller owns 'mem' and must have called ptls_buffer_init prior to
* invoking this function */
int ptls_cred_buffer_set_from_file(ptls_cred_buffer_t *buf, const char *fname)
{
FILE *fp = NULL;
ssize_t sz;
char *m = NULL;
#ifdef _WINDOWS
errno_t err = fopen_s(&fp, fname, "r");
if (err != 0) {
return -1;
}
#else
fp = fopen(fname, "r");
if (fp == NULL) {
return -1;
}
#endif
if ((sz = fsize(fp)) == -1 ||
(m = malloc(sz)) == NULL ||
fread(m, sz, 1, fp) != 1) {
goto err;
}
(void) fclose(fp);
buf->base = m;
buf->len = sz;
buf->off = 0;
buf->owns_base = 1;
return 0;
err:
if (m)
free(m);
if (fp != NULL)
(void) fclose(fp);
return -1;
}
int ptls_cred_buffer_set_from_string(ptls_cred_buffer_t *buf, char *s)
{
buf->base = s;
buf->len = strlen(s);
buf->off = 0;
buf->owns_base = 0;
return 0;
}
void ptls_cred_buffer_dispose(ptls_cred_buffer_t *buf)
{
if (buf->owns_base) {
if (buf->base) {
free(buf->base);
buf->base = NULL;
}
buf->len = buf->off = 0;
buf->owns_base = 0;
}
return;
}
void ptls_cred_buffer_rewind(ptls_cred_buffer_t *buf)
{
buf->off = 0;
return;
}
/* z -> nlptr */
char *ptls_cred_buffer_gets(char *s, int n, ptls_cred_buffer_t *buf)
{
char *p = s;
char *z;
size_t k;
int c;
if (n-- <= 1) {
if (n) return NULL;
*s = '\0';
return s;
}
while (n) {
if (PTLS_CRED_BUFFER_RPOS(buf) != PTLS_CRED_BUFFER_REND(buf)) {
z = memchr(PTLS_CRED_BUFFER_RPOS(buf), '\n', PTLS_CRED_BUFFER_LEFT(buf));
k = z ? z - PTLS_CRED_BUFFER_RPOS(buf) + 1 : PTLS_CRED_BUFFER_LEFT(buf);
k = MIN(k, n);
memcpy(p, PTLS_CRED_BUFFER_RPOS(buf), k);
buf->off += k;
p += k;
n -= k;
if (z || !n) break;
}
if ((c = cred_buffer_getc(buf)) < 0) {
if (p == s || PTLS_CRED_BUFFER_LEFT(buf) > 0) s = NULL;
break;
}
n--;
if ((*p++ = c) == '\n') break;
}
if (s) *p = '\0';
return s;
}

24
build/lib/includes/utils/cred_buffer.h
View File

@@ -1,24 +0,0 @@
#ifndef PTLS_CRED_BUFFER_H
#define PTLS_CRED_BUFFER_H
#include <stddef.h>
#include "picotls.h"
typedef struct ptls_cred_buffer_s {
char *base;
size_t len;
size_t off;
int owns_base;
#define PTLS_CRED_BUFFER_RPOS(buf) ((buf)->base + (buf)->off)
#define PTLS_CRED_BUFFER_REND(buf) ((buf)->base + (buf)->len)
#define PTLS_CRED_BUFFER_LEFT(buf) ((buf)->len - (buf)->off)
} ptls_cred_buffer_t;
int ptls_cred_buffer_set_from_file(ptls_cred_buffer_t *buf, const char *fname);
int ptls_cred_buffer_set_from_string(ptls_cred_buffer_t *buf, char *s);
void ptls_cred_buffer_dispose(ptls_cred_buffer_t *buf);
void ptls_cred_buffer_rewind(ptls_cred_buffer_t *buf);
char *ptls_cred_buffer_gets(char *s, int n, ptls_cred_buffer_t *buf);
#endif /* !PTLS_CRED_BUFFER_H */

28
build/lib/includes/utils/pem_utils.h
View File

@@ -1,28 +0,0 @@
/*
* Copyright (c) 2017 Christian Huitema <huitema@huitema.net>
*
* Permission to use, copy, modify, and distribute this software for any
* purpose with or without fee is hereby granted, provided that the above
* copyright notice and this permission notice appear in all copies.
*
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
*/
#ifndef PTLS_PEM_UTILS
#define PTLS_PEM_UTILS
#include <picotls.h>
#include <picotls/openssl.h>
#include "cred_buffer.h"
int ptls_load_certificates_from_memory(ptls_context_t *ctx, ptls_cred_buffer_t *mem);
int ptls_openssl_init_sign_certificate_with_mem_key(ptls_openssl_sign_certificate_t *self, const void *buf, int len);
#endif /* PTLS_PEM_UTILS */

152
build/lib/pem_utils.c
View File

@@ -1,152 +0,0 @@
#include <stdlib.h>
#include <picotls.h>
#include <picotls/pembase64.h>
#include "utils/pem_utils.h"
#include <openssl/pem.h>
#include <openssl/evp.h>
#include <openssl/ec.h>
#include <openssl/err.h>
static int ptls_compare_separator_line(const char *line, const char *begin_or_end, const char *label)
{
int ret = strncmp(line, "-----", 5);
size_t text_index = 5;
if (ret == 0) {
size_t begin_or_end_length = strlen(begin_or_end);
ret = strncmp(line + text_index, begin_or_end, begin_or_end_length);
text_index += begin_or_end_length;
}
if (ret == 0) {
ret = line[text_index] - ' ';
text_index++;
}
if (ret == 0) {
size_t label_length = strlen(label);
ret = strncmp(line + text_index, label, label_length);
text_index += label_length;
}
if (ret == 0) {
ret = strncmp(line + text_index, "-----", 5);
}
return ret;
}
// Extracted from https://github.com/h2o/picotls/pull/284/
// Remove both pem.c/h and cred_buffer.c/h once that PR gets merged
static int ptls_get_pem_object_from_memory(ptls_cred_buffer_t *mem, const char *label, ptls_buffer_t *buf)
{
int ret = PTLS_ERROR_PEM_LABEL_NOT_FOUND;
char line[256];
ptls_base64_decode_state_t state;
/* Get the label on a line by itself */
while (ptls_cred_buffer_gets(line, 256, mem)) {
if (ptls_compare_separator_line(line, "BEGIN", label) == 0) {
ret = 0;
ptls_base64_decode_init(&state);
break;
}
}
/* Get the data in the buffer */
while (ret == 0 && ptls_cred_buffer_gets(line, 256, mem)) {
if (ptls_compare_separator_line(line, "END", label) == 0) {
if (state.status == PTLS_BASE64_DECODE_DONE || (state.status == PTLS_BASE64_DECODE_IN_PROGRESS && state.nbc == 0)) {
ret = 0;
} else {
ret = PTLS_ERROR_INCORRECT_BASE64;
}
break;
} else {
ret = ptls_base64_decode(line, &state, buf);
}
}
return ret;
}
int ptls_load_pem_objects_from_memory(ptls_cred_buffer_t *mem, const char *label, ptls_iovec_t *list, size_t list_max, size_t *nb_objects)
{
int ret = 0;
size_t count = 0;
*nb_objects = 0;
if (ret == 0) {
while (count < list_max) {
ptls_buffer_t buf;
ptls_buffer_init(&buf, "", 0);
ret = ptls_get_pem_object_from_memory(mem, label, &buf);
if (ret == 0) {
if (buf.off > 0 && buf.is_allocated) {
list[count].base = buf.base;
list[count].len = buf.off;
count++;
} else {
ptls_buffer_dispose(&buf);
}
} else {
ptls_buffer_dispose(&buf);
break;
}
}
}
if (ret == PTLS_ERROR_PEM_LABEL_NOT_FOUND && count > 0) {
ret = 0;
}
*nb_objects = count;
return ret;
}
#define PTLS_MAX_CERTS_IN_CONTEXT 16
int ptls_load_certificates_from_memory(ptls_context_t *ctx, ptls_cred_buffer_t *mem)
{
int ret = 0;
ctx->certificates.list = (ptls_iovec_t *)malloc(PTLS_MAX_CERTS_IN_CONTEXT * sizeof(ptls_iovec_t));
if (ctx->certificates.list == NULL) {
ret = PTLS_ERROR_NO_MEMORY;
} else {
ret = ptls_load_pem_objects_from_memory(mem, "CERTIFICATE", ctx->certificates.list, PTLS_MAX_CERTS_IN_CONTEXT,
&ctx->certificates.count);
}
return ret;
}
int ptls_openssl_init_sign_certificate_with_mem_key(ptls_openssl_sign_certificate_t *self, const void *buf, int len) {
BIO *bio = BIO_new_mem_buf(buf, len);
if (bio == NULL) {
return 8880;
}
EVP_PKEY *evp_key = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
BIO_free(bio);
if (evp_key == NULL) {
return 8881;
}
// Initialize the certificate signing structure
int ret = ptls_openssl_init_sign_certificate(self, evp_key);
EVP_PKEY_free(evp_key);
return ret;
}

51
build_libs.sh Executable file
View File

@@ -0,0 +1,51 @@
#!/bin/bash
set -euo pipefail
root=$(dirname "$0")
sources=${root}/libs
tmpdir=$(mktemp -d)
force_i386=false
# check args
for arg in "$@"; do
case "$arg" in
--i386)
force_i386=true
;;
*)
echo "unknown arg: $arg" >&2
exit 1
;;
esac
done
cmake_args=(
-DCMAKE_BUILD_TYPE=Release
-DBUILD_SHARED_LIBS=OFF
-DBUILD_TESTING=OFF
-DFIPS=OFF
-DBUILD_TOOL=OFF
-DDISABLE_GO=ON
)
# optionally inject i386 toolchain
if [ "$force_i386" = true ]; then
toolchain_file=$(mktemp)
cat > "$toolchain_file" <<EOF
set(CMAKE_SYSTEM_NAME Linux)
set(CMAKE_SYSTEM_PROCESSOR i386)
set(CMAKE_C_FLAGS "\${CMAKE_C_FLAGS} -m32")
set(CMAKE_CXX_FLAGS "\${CMAKE_CXX_FLAGS} -m32")
EOF
cmake_args+=("-DCMAKE_TOOLCHAIN_FILE=$toolchain_file")
fi
# build aws-lc
mkdir -p ./libs/aws-lc/build
pushd ./libs/aws-lc/build
cmake ../ "${cmake_args[@]}"
make
popd
cp ./libs/aws-lc/build/ssl/libssl.a ./build/.
cp ./libs/aws-lc/build/crypto/libcrypto.a ./build/.

16
config.nims
View File

@@ -1,5 +1,15 @@
--styleCheck:usages
when not defined(windows):
# use the C++ linker profile because it's a C++ library
when defined(macosx):
switch("clang.linkerexe", "clang++")
else:
switch("gcc.linkerexe", "g++")
--styleCheck:
usages
if (NimMajor, NimMinor) < (1, 6):
--styleCheck:hint
--styleCheck:
hint
else:
--styleCheck:error
--styleCheck:
error

15
extras.nim
View File

@@ -1,18 +1,3 @@
type
ptls_handshake_properties_t_anon0_t* = struct_st_ptls_handshake_properties_t_anon0_t
ptls_handshake_properties_t_anon0_t_client_t* =
struct_st_ptls_handshake_properties_t_anon0_t_client_t
ptls_handshake_properties_t_anon0_t_client_t_negotiated_protocols_t* =
struct_st_ptls_handshake_properties_t_anon0_t_client_t_negotiated_protocols_t
ptls_handshake_properties_t_anon0_t_client_t_ech_t* =
struct_st_ptls_handshake_properties_t_anon0_t_client_t_ech_t
ptls_handshake_properties_t_anon0_t_server_t* =
struct_st_ptls_handshake_properties_t_anon0_t_server_t
ptls_handshake_properties_t_anon0_t_server_t_selected_psk_binder_t* =
struct_st_ptls_handshake_properties_t_anon0_t_server_t_selected_psk_binder_t
ptls_handshake_properties_t_anon0_t_server_t_cookie_t* =
struct_st_ptls_handshake_properties_t_anon0_t_server_t_cookie_t
when defined(ngtcp2_enable_quictls):
# OpenSSL/QuicTLS crypto support
# OpenSSL/QuicTLS type definitions

23
generate_ngtcp2.nim
View File

@@ -1,16 +1,13 @@
import futhark, strformat
import futhark
from os import parentDir, `/`
importc:
outputPath currentSourcePath.parentDir / "tmp_ngtcp2.nim"
path currentSourcePath.parentDir/"libs/ngtcp2/lib/includes"
path currentSourcePath.parentDir/"build/lib/includes"
path currentSourcePath.parentDir/"libs/ngtcp2/crypto/includes/"
path currentSourcePath.parentDir/"libs"/"picotls"/"include"
"ngtcp2/ngtcp2.h"
"ngtcp2/ngtcp2_crypto.h"
"picotls.h"
"picotls/openssl.h"
"ngtcp2/ngtcp2_crypto_picotls.h"
"utils/cred_buffer.h"
"utils/pem_utils.h"
outputPath currentSourcePath.parentDir / "tmp_ngtcp2.nim"
path currentSourcePath.parentDir / "libs/ngtcp2/lib/includes"
path currentSourcePath.parentDir / "build/lib/includes"
path currentSourcePath.parentDir / "libs/ngtcp2/crypto/includes"
path currentSourcePath.parentDir / "libs/aws-lc/include"
rename FILE, CFile # Rename `FILE` that STB uses to `CFile` which is the Nim equivalent
"ngtcp2/ngtcp2.h"
"ngtcp2/ngtcp2_crypto_boringssl.h"
"openssl/ssl.h"

1
libs/aws-lc Submodule

Submodule libs/aws-lc added at 8ca0b29b14

2
libs/ngtcp2

Submodule libs/ngtcp2 updated: 048cdfd0c2...b6f2c756af

1
libs/picotls

Submodule libs/picotls deleted from bbcdbe6dc3

82276
ngtcp2.nim
View File

File diff suppressed because it is too large Load Diff

25
ngtcp2.nimble
View File

@@ -1,5 +1,5 @@
packageName = "ngtcp2"
version = "0.38.0"
version = "0.39.0"
author = "Status Research & Development GmbH"
description = "Nim wrapper around the ngtcp2 library"
license = "MIT"
@@ -7,3 +7,26 @@ installDirs = @["libs", "build"]
installFiles = @["ngtcp2.nim"]
requires "nim >= 1.6.0"
template build() =
when defined(windows):
exec "./build_libs.sh"
else:
let targetCpu = getEnv("TARGET_CPU", hostCPU)
if targetCpu == "i386":
exec "./build_libs.sh --i386"
else:
exec "./build_libs.sh"
before install:
build()
task format, "Format nim code using nph":
exec "nimble install nph"
exec "nph ."
task test, "Run tests":
when defined(windows):
exec "nim c -d:nimDebugDlOpen -r --threads:on tests/testNgtcp2.nim"
else:
exec "nim c -r --threads:on tests/testNgtcp2.nim"

35
prelude.nim
View File

@@ -1,23 +1,30 @@
import os
import strformat
import strformat, strutils
# Socket definitions
import nativesockets
{.passc: "-DNGTCP2_STATICLIB".}
when defined(windows):
# TODO: test this
{.push importc, cdecl, dynlib: "libcrypto.dll".}
{.push importc, cdecl, dynlib: "libssl.dll".}
else:
const
topLevelPath = currentSourcePath.parentDir()
libsDir = topLevelPath.replace('\\', '/') & "/build/"
{.passl: libsDir & "/libssl.a".}
{.passl: libsDir & "/libcrypto.a".}
{.localPassC: "-DNGTCP2_STATICLIB".}
when defined(windows):
{.passl: "-lws2_32".}
{.passc: "-D_WINDOWS".}
{.passc: "-D__CRT__NO_INLINE".}
{.localPassC: "-D_WINDOWS".}
{.localPassC: "-D__CRT__NO_INLINE".}
else:
{.passc: "-DHAVE_UNISTD_H".}
{.localPassC: "-DHAVE_UNISTD_H".}
when defined(macosx):
{.passl: "-L/opt/homebrew/opt/openssl@3/lib -lcrypto".}
{.passc: "-I/opt/homebrew/opt/openssl@3/include".}
else:
{.passl: "-lcrypto".}
const root = currentSourcePath.parentDir
const libIncludes = root / "build" / "lib" / "includes"
@@ -25,16 +32,16 @@ const ngtcp2Crypto = root / "libs" / "ngtcp2" / "crypto"
const ngtcp2CryptoIncludes = root / "libs" / "ngtcp2" / "crypto" / "includes"
const ngtcp2Lib = root / "libs" / "ngtcp2" / "lib"
const ngtcp2LibIncludes = root / "libs" / "ngtcp2" / "lib" / "includes"
const picotlsInclude = root / "libs" / "picotls" / "include"
const awsLcInclude = root / "libs" / "aws-lc" / "include"
{.passc: fmt"-I{libIncludes}".}
{.passc: fmt"-I{ngtcp2Crypto}".}
{.passc: fmt"-I{ngtcp2CryptoIncludes}".}
{.passc: fmt"-I{ngtcp2Lib}".}
{.passc: fmt"-I{ngtcp2LibIncludes}".}
{.passc: fmt"-I{picotlsInclude}".}
{.passc: fmt"-I{awsLcInclude}".}
when defined(ngtcp2_enable_quictls):
# QuicTLS/OpenSSL crypto support
{.localpassc: "-DNGTCP2_CRYPTO_QUICTLS".}
{.localpassc: "-I/usr/include/openssl".}
{.localPassC: "-DNGTCP2_CRYPTO_QUICTLS".}
{.passc: "-I/usr/include/openssl".}

15
tests/testNgtcp2.nim
View File

@@ -12,16 +12,13 @@ test "default settings":
)
check transport_params.active_connection_id_limit > 0
test "ptls_instantiation":
var ctx: ptls_context_t
ctx.random_bytes = ptls_openssl_random_bytes
ctx.get_time = addr ptls_get_time
ctx.key_exchanges =
cast[ptr ptr ptls_key_exchange_algorithm_t](addr ptls_openssl_key_exchanges[0])
ctx.cipher_suites = cast[ptr ptr ptls_cipher_suite_t](ptls_openssl_cipher_suites[0])
test "AWS-LC bindings":
let
clientMethod = TLS_client_method()
ssl_ctx = SSL_CTX_new(clientMethod)
ssl = SSL_new(ssl_ctx)
var tls: ptr ptls_t = ptls_client_new(addr ctx)
check tls != nil
check ssl != nil
when defined(ngtcp2_enable_quictls):
test "QuicTLS bindings":