{"action":"created","issue":{"url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/issues/534","labels_url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/issues/534/labels{/name}","comments_url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/issues/534/comments","events_url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/issues/534/events","html_url":"https://github.com/OpenSMTPD/OpenSMTPD/issues/534","id":56207245,"number":534,"title":"Switch from OpenSSL to LibreSSL ... then switch to libtls API","user":{"login":"poolpOrg","id":895503,"avatar_url":"https://avatars.githubusercontent.com/u/895503?v=3","gravatar_id":"","url":"https://api.github.com/users/poolpOrg","html_url":"https://github.com/poolpOrg","followers_url":"https://api.github.com/users/poolpOrg/followers","following_url":"https://api.github.com/users/poolpOrg/following{/other_user}","gists_url":"https://api.github.com/users/poolpOrg/gists{/gist_id}","starred_url":"https://api.github.com/users/poolpOrg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poolpOrg/subscriptions","organizations_url":"https://api.github.com/users/poolpOrg/orgs","repos_url":"https://api.github.com/users/poolpOrg/repos","events_url":"https://api.github.com/users/poolpOrg/events{/privacy}","received_events_url":"https://api.github.com/users/poolpOrg/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/labels/build","name":"build","color":"fbca04"}],"state":"open","locked":false,"assignee":{"login":"poolpOrg","id":895503,"avatar_url":"https://avatars.githubusercontent.com/u/895503?v=3","gravatar_id":"","url":"https://api.github.com/users/poolpOrg","html_url":"https://github.com/poolpOrg","followers_url":"https://api.github.com/users/poolpOrg/followers","following_url":"https://api.github.com/users/poolpOrg/following{/other_user}","gists_url":"https://api.github.com/users/poolpOrg/gists{/gist_id}","starred_url":"https://api.github.com/users/poolpOrg/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/poolpOrg/subscriptions","organizations_url":"https://api.github.com/users/poolpOrg/orgs","repos_url":"https://api.github.com/users/poolpOrg/repos","events_url":"https://api.github.com/users/poolpOrg/events{/privacy}","received_events_url":"https://api.github.com/users/poolpOrg/received_events","type":"User","site_admin":false},"milestone":null,"comments":4,"created_at":"2015-02-02T08:14:48Z","updated_at":"2015-02-02T15:40:28Z","closed_at":null,"body":"This ticket is intended to stay open for a bit, it is not an overnight switch\r\n----------------------------------------------------------------------------------------\r\n\r\n**First, a bit of rationale**\r\n\r\nOpenSMTPD has relied heavily on OpenSSL from day one and it has been painful all along as the daemon was designed to run chrooted with privilege separation and the OpenSSL API deals very badly with that, expecting to be able to read a file at runtime or not providing an asynchronous way to validate a certificate during a handshake.\r\n\r\nTo cope with that, OpenSMTPD like other OpenBSD daemons, shipped with a file which reimplemented the bits we needed from OpenSSL but which were lacking. This file had functions to load a private key into a buffer and work from that buffer where OpenSSL would try to load from file for instance. It does stuff it shouldn't do, because OpenSSL doesn't do it itself.\r\n\r\nTo add to the mess, the portable version of OpenSMTPD builds on various Linux distros which run various versions of OpenSSL including old ones, and which enable or not some features we rely upon: the two that pop to mind are support for AES GCM mode or TLS SNI extension. Testing the version is so brainfucked it was actually done wrong and this resulted in issues on some Linux distros just a few months ago.\r\n\r\nWe end up having a check for the OpenSSL version in our configure layer to determine if it is completely out of touch with us, then adding ifdef's at different places in the code to test if we can support this feature or if OpenSSL has been built without it... when the feature is really a no-brainer... and eventually to errors when I try to build the portable snapshot on my Linux, see it works, then someone realizes there is a missing ifdef for his particular version of OpenSSL after I publish a snapshot.\r\n\r\nTo add to the mess, LibreSSL was released recently and it is doing things right. The privilege separation enabled functions are there, there is no conditional this or that and based on a LibreSSL version we know what features are present. To avoid conflict, the functions we had reimplemented were removed from OpenBSD and therefore they end up in the compat layer of our portable branch. We now have to detect if we're running LibreSSL and don't need that shit... or if we're running OpenSSL and have to cope with the version and features mess.\r\n\r\nFinally, LibreSSL comes with libtls which simplifies by a GREAT BUNCH the entire TLS layer by providing a very simple function set rather than forcing us to deal with the OpenSSL API and its mysterious ways (only slightly exaggerating). It's good and all, yet we can't use it because we're currently stuck with OpenSSL.\r\n\r\n\r\n**So, what's the plan ?**\r\n\r\nThe plan is to progressively roll out of OpenSSL.\r\n\r\nFirst, we stop mentioning OpenSSL in the configure layer, we WANT LibreSSL. It doesn't have to be the very last version, it has to be a version >= X where X provides the features we rely upon.\r\n\r\nThen, we start phasing out some ifdefs, we stop supporting Linux systems that ship with a very ancient OpenSSL or with the features we rely upon disabled. If OpenSSL already fucks up on recent releases why are we even trying to work with 0.9.x releases ?? We should be pushing for a better Internet not helping distros ship old broken libraries for convenience...\r\n\r\nWhen this is done, we can remove the #ifdef's that are here and there in our code, at this point we can make LibreSSL out main dependency. People running OpenSSL will still be able to rely upon it **if it is a recent OpenSSL**.\r\n\r\nWe don't intend to break OpenSMTPD overnight for OpenSSL users, we rather want it to work with a \"degraded\" build mode where using OpenSSL will only work if you don't build OpenSSL with random enable/disable flags and if you stick with a post-1.0.x version.\r\n\r\nWe want to push for better, just slowly enough to not fuck every one up, but enough to actually make things better rather than stay in the OpenSSL era of broken code.\r\n\r\n\r\n**libtls**\r\n\r\nWhen we have enough feedback from the Linux community that LibreSSL has been packaged, we can start relying on libtls and cleaning up the mta and smtp code to use the simpler interface.\r\n\r\nThis will be done in parallel actually but we can only switch to it once we know that we can rely fully on LibreSSL and that OpenSSL has been buried.\r\n"},"comment":{"url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/issues/comments/72477851","html_url":"https://github.com/OpenSMTPD/OpenSMTPD/issues/534#issuecomment-72477851","issue_url":"https://api.github.com/repos/OpenSMTPD/OpenSMTPD/issues/534","id":72477851,"user":{"login":"dfateyev","id":727201,"avatar_url":"https://avatars.githubusercontent.com/u/727201?v=3","gravatar_id":"","url":"https://api.github.com/users/dfateyev","html_url":"https://github.com/dfateyev","followers_url":"https://api.github.com/users/dfateyev/followers","following_url":"https://api.github.com/users/dfateyev/following{/other_user}","gists_url":"https://api.github.com/users/dfateyev/gists{/gist_id}","starred_url":"https://api.github.com/users/dfateyev/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dfateyev/subscriptions","organizations_url":"https://api.github.com/users/dfateyev/orgs","repos_url":"https://api.github.com/users/dfateyev/repos","events_url":"https://api.github.com/users/dfateyev/events{/privacy}","received_events_url":"https://api.github.com/users/dfateyev/received_events","type":"User","site_admin":false},"created_at":"2015-02-02T15:40:28Z","updated_at":"2015-02-02T15:40:28Z","body":"Well, I'm fine as long as we can use OpenSSL available in Fedora.\r\nAs for the future, I don't know, maybe Fedora technical committee will take an official decision."}}