@cryptotaxi247 / netdata-1 / commits / 75792b33e

Revert "Support to WolfSSL (Step 1)" (#17697)

Revert "Support to WolfSSL (Step 1) (#17516)" This reverts commit 8d9c464de3f79f2e92fe6c46894ad2e09dd8f4d5.

Stelios Fragkakis committed May 17, 2024 at 19:08 UTC 75792b33e28aa4813a14f7cefa5b24e3d713e163
22 files changed +65 -210
CMakeLists.txt
+25 -49
@@ -126,13 +126,9 @@ set(CONFIG_H ${CONFIG_H_DIR}/config.h)
126 option(DEFAULT_FEATURE_STATE "Specify the default state for most optional features" True)
127 mark_as_advanced(DEFAULT_FEATURE_STATE)
128
129 -# ssl
130 -option(ENABLE_WOLFSSL "Compile netdata using WolfSSL." False)
131 -cmake_dependent_option(ENABLE_OPENSSL "Compile netdata using OpenSSL." True "NOT ENABLE_WOLFSSL" False)
132 -
129 # High-level features
134 -cmake_dependent_option(ENABLE_ACLK "Enable Netdata Cloud support (ACLK)" ${DEFAULT_FEATURE_STATE} "NOT ENABLE_WOLFSSL" False)
135 -cmake_dependent_option(ENABLE_CLOUD "Enable Netdata Cloud by default at runtime" ${DEFAULT_FEATURE_STATE} "NOT ENABLE_WOLFSSL" False)
130 +option(ENABLE_ACLK "Enable Netdata Cloud support (ACLK)" ${DEFAULT_FEATURE_STATE})
131 +option(ENABLE_CLOUD "Enable Netdata Cloud by default at runtime" ${DEFAULT_FEATURE_STATE})
132 option(ENABLE_ML "Enable machine learning features" ${DEFAULT_FEATURE_STATE})
133 option(ENABLE_DBENGINE "Enable dbengine metrics storage" True)
134
@@ -147,7 +143,7 @@ mark_as_advanced(ENABLE_LEGACY_EBPF_PROGRAMS)
143 option(ENABLE_PLUGIN_FREEIPMI "Enable IPMI monitoring" ${DEFAULT_FEATURE_STATE})
144 option(ENABLE_PLUGIN_GO "Enable metric collectors written in Go" ${DEFAULT_FEATURE_STATE})
145 option(ENABLE_PLUGIN_LOCAL_LISTENERS "Enable local listening socket tracking (including service auto-discovery support)" ${DEFAULT_FEATURE_STATE})
150 -cmake_dependent_option(ENABLE_PLUGIN_LOGS_MANAGEMENT "Enable log collection and monitoring based on Fluent Bit" ${DEFAULT_FEATURE_STATE} "NOT ENABLE_WOLFSSL" False)
146 +option(ENABLE_PLUGIN_LOGS_MANAGEMENT "Enable log collection and monitoring based on Fluent Bit" ${DEFAULT_FEATURE_STATE})
147 option(ENABLE_PLUGIN_NETWORK_VIEWER "Enable network viewer functionality" ${DEFAULT_FEATURE_STATE})
148 option(ENABLE_PLUGIN_NFACCT "Enable Linux NFACCT metric collection" ${DEFAULT_FEATURE_STATE})
149 option(ENABLE_PLUGIN_PERF "Enable Linux performance counter monitoring" ${DEFAULT_FEATURE_STATE})
@@ -171,8 +167,7 @@ mark_as_advanced(ENABLE_LOGS_MANAGEMENT_TESTS)
167 # Experimental features
168 option(ENABLE_WEBRTC "Enable WebRTC dashboard communications (experimental)" False)
169 mark_as_advanced(ENABLE_WEBRTC)
174 -
175 -cmake_dependent_option(ENABLE_H2O "Enable H2O web server (experimental)" True "NOT ENABLE_WOLFSSL" False)
170 +option(ENABLE_H2O "Enable H2O web server (experimental)" True)
171 mark_as_advanced(ENABLE_H2O)
172
173 # Other optional functionality
@@ -185,21 +180,6 @@ mark_as_advanced(BUILD_FOR_PACKAGING)
180 cmake_dependent_option(FORCE_LEGACY_LIBBPF "Force usage of libbpf 0.0.9 instead of the latest version." False "ENABLE_PLUGIN_EBPF" False)
181 mark_as_advanced(FORCE_LEGACY_LIBBPF)
182
188 -include(CheckFunctionExists)
189 -
190 -if(ENABLE_WOLFSSL)
191 - pkg_check_modules(WOLFSSL wolfssl)
192 -
193 - list(APPEND CMAKE_REQUIRED_LIBRARIES wolfssl)
194 - check_function_exists(wolfSSL_set_alpn_protos HAVE_WOLFSSL_SET_ALPN_PROTOS)
195 - if(NOT HAVE_WOLFSSL_SET_ALPN_PROTOS)
196 - message(FATAL_ERROR "Your WolfSSL library has not been compiled with the OPENSSL_EXTRA flag, which is necessary to create symbols for the OpenSSL API that Netdata uses.")
197 - endif()
198 -else()
199 - # openssl/crypto
200 - pkg_check_modules(OPENSSL openssl)
201 -endif()
202 -
183 if(ENABLE_ACLK OR ENABLE_EXPORTER_PROMETHEUS_REMOTE_WRITE)
184 set(NEED_PROTOBUF True)
185 else()
@@ -308,6 +288,11 @@ endif()
288 # Libm
289 #
290
291 +# checks link with cmake required libs
292 +cmake_policy(SET CMP0075 NEW)
293 +
294 +include(CheckFunctionExists)
295 +
296 check_function_exists(log10 HAVE_LOG10)
297 if(NOT HAVE_LOG10)
298 unset(HAVE_LOG10 CACHE)
@@ -561,7 +546,11 @@ if(FREEBSD OR MACOS)
546 set(HAVE_BUILTIN_ATOMICS True)
547 endif()
548
564 -if(NOT OPENSSL_FOUND AND ENABLE_OPENSSL)
549 +# openssl/crypto
550 +set(ENABLE_OPENSSL True)
551 +pkg_check_modules(OPENSSL openssl)
552 +
553 +if(NOT OPENSSL_FOUND)
554 if(MACOS)
555 execute_process(COMMAND
556 brew --prefix --installed openssl
@@ -581,7 +570,7 @@ if(NOT OPENSSL_FOUND AND ENABLE_OPENSSL)
570 endif()
571 endif()
572
584 -if(NOT MACOS AND ENABLE_OPENSSL)
573 +if(NOT MACOS)
574 pkg_check_modules(CRYPTO libcrypto)
575 endif()
576
@@ -703,7 +692,6 @@ set(LIBNETDATA_FILES
692 src/libnetdata/required_dummies.h
693 src/libnetdata/socket/security.c
694 src/libnetdata/socket/security.h
706 - src/libnetdata/ssl/ssl.h
695 src/libnetdata/simple_pattern/simple_pattern.c
696 src/libnetdata/simple_pattern/simple_pattern.h
697 src/libnetdata/socket/socket.c
@@ -1430,7 +1418,7 @@ set(NETDATA_FILES
1418 ${WEB_PLUGIN_FILES}
1419 ${CLAIM_PLUGIN_FILES}
1420 ${SPAWN_PLUGIN_FILES}
1433 - "$<$<BOOL:${ENABLE_OPENSSL}>:${ACLK_ALWAYS_BUILD}>"
1421 + ${ACLK_ALWAYS_BUILD}
1422 ${PROFILE_PLUGIN_FILES}
1423 )
1424
@@ -1725,26 +1713,15 @@ target_include_directories(libnetdata BEFORE PUBLIC ${LIBUV_INCLUDE_DIRS})
1713 target_compile_options(libnetdata PUBLIC ${LIBUV_CFLAGS_OTHER})
1714 target_link_libraries(libnetdata PUBLIC ${LIBUV_LDFLAGS})
1715
1728 -if (ENABLE_OPENSSL)
1729 - message(STATUS "Compiling Netdata with OpenSSL")
1730 - # crypto
1731 - target_include_directories(libnetdata BEFORE PUBLIC ${CRYPTO_INCLUDE_DIRS})
1732 - target_compile_options(libnetdata PUBLIC ${CRYPTO_CFLAGS_OTHER})
1733 - target_link_libraries(libnetdata PUBLIC ${CRYPTO_LDFLAGS})
1716 +# crypto
1717 +target_include_directories(libnetdata BEFORE PUBLIC ${CRYPTO_INCLUDE_DIRS})
1718 +target_compile_options(libnetdata PUBLIC ${CRYPTO_CFLAGS_OTHER})
1719 +target_link_libraries(libnetdata PUBLIC ${CRYPTO_LDFLAGS})
1720
1735 - # openssl
1736 - target_include_directories(libnetdata BEFORE PUBLIC ${OPENSSL_INCLUDE_DIRS})
1737 - target_compile_options(libnetdata PUBLIC ${OPENSSL_CFLAGS_OTHER})
1738 - target_link_libraries(libnetdata PUBLIC ${OPENSSL_LDFLAGS})
1739 -endif()
1740 -
1741 -if (ENABLE_WOLFSSL)
1742 - message(STATUS "Compiling Netdata with WolfSSL")
1743 -
1744 - target_include_directories(libnetdata BEFORE PUBLIC ${WOLFSSL_INCLUDE_DIRS})
1745 - target_compile_options(libnetdata PUBLIC ${WOLFSSL_CFLAGS_OTHER})
1746 - target_link_libraries(libnetdata PUBLIC ${WOLFSSL_LDFLAGS})
1747 -endif()
1721 +# openssl
1722 +target_include_directories(libnetdata BEFORE PUBLIC ${OPENSSL_INCLUDE_DIRS})
1723 +target_compile_options(libnetdata PUBLIC ${OPENSSL_CFLAGS_OTHER})
1724 +target_link_libraries(libnetdata PUBLIC ${OPENSSL_LDFLAGS})
1725
1726 # mnl
1727 if(NOT MACOS)
@@ -1772,8 +1749,7 @@ if(ENABLE_MQTTWEBSOCKETS)
1749
1750 target_compile_options(mqttwebsockets PUBLIC -DMQTT_WSS_CUSTOM_ALLOC
1751 -DRBUF_CUSTOM_MALLOC
1775 - -DMQTT_WSS_CPUSTATS
1776 - )
1752 + -DMQTT_WSS_CPUSTATS)
1753
1754 target_include_directories(mqttwebsockets PUBLIC ${CMAKE_SOURCE_DIR}/aclk/helpers
1755 ${CMAKE_SOURCE_DIR}/src/web/server/h2o/libh2o/include)
packaging/cmake/config.cmake.h.in
-1
@@ -105,7 +105,6 @@
105 // enabled features
106
107 #cmakedefine ENABLE_OPENSSL
108 -#cmakedefine ENABLE_WOLFSSL
108 #cmakedefine ENABLE_CLOUD
109 #cmakedefine ENABLE_ACLK
110 #cmakedefine ENABLE_ML
src/aclk/aclk.c
-2
@@ -62,9 +62,7 @@ struct aclk_shared_state aclk_shared_state = {
62 };
63
64 #ifdef MQTT_WSS_DEBUG
65 -#if defined(ENABLE_OPENSSL)
65 #include <openssl/ssl.h>
67 -#endif
66 #define DEFAULT_SSKEYLOGFILE_NAME "SSLKEYLOGFILE"
67 const char *ssl_log_filename = NULL;
68 FILE *ssl_log_file = NULL;
src/aclk/mqtt_websockets/mqtt_wss_client.c
-8
@@ -23,25 +23,17 @@
23 #include <netinet/tcp.h> //TCP_NODELAY
24 #include <netdb.h>
25
26 -#ifdef ENABLE_OPENSSL
26 #include <openssl/err.h>
27 #include <openssl/ssl.h>
29 -#elif defined(ENABLE_WOLFSSL)
30 -#include <wolfssl/options.h>
31 -#include <wolfssl/openssl/err.h>
32 -#include <wolfssl/openssl/ssl.h>
33 -#endif
28
29 #define PIPE_READ_END 0
30 #define PIPE_WRITE_END 1
31 #define POLLFD_SOCKET 0
32 #define POLLFD_PIPE 1
33
40 -#if defined(ENABLE_OPENSSL)
34 #if (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110) && (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097)
35 #include <openssl/conf.h>
36 #endif
44 -#endif //ENABLE_OPENSSL
37
38 //TODO MQTT_PUBLISH_RETAIN should not be needed anymore
39 #define MQTT_PUBLISH_RETAIN 0x01
src/aclk/mqtt_websockets/mqtt_wss_client.h
-5
@@ -155,12 +155,7 @@ struct mqtt_wss_stats {
155 struct mqtt_wss_stats mqtt_wss_get_stats(mqtt_wss_client client);
156
157 #ifdef MQTT_WSS_DEBUG
158 -#ifdef ENABLE_OPENSSL
158 #include <openssl/ssl.h>
160 -#elif defined(ENABLE_WOLFSSL)
161 -#include <wolfssl/options.h>
162 -#include <wolfssl/openssl/ssl.h>
163 -#endif
159 void mqtt_wss_set_SSL_CTX_keylog_cb(mqtt_wss_client client, void (*ssl_ctx_keylog_cb)(const SSL *ssl, const char *line));
160 #endif
161
src/aclk/mqtt_websockets/ws_client.c
-5
@@ -17,12 +17,7 @@
17 #include <errno.h>
18 #include <ctype.h>
19
20 -#ifdef ENABLE_OPENSSL
20 #include <openssl/evp.h>
22 -#elif defined(ENABLE_WOLFSSL)
23 -#include <wolfssl/options.h>
24 -#include <wolfssl/openssl/evp.h>
25 -#endif
21
22 #include "ws_client.h"
23 #include "common_internal.h"
src/claim/claim.c
+1 -1
@@ -52,7 +52,7 @@ CLAIM_AGENT_RESPONSE claim_agent(const char *claiming_arguments, bool force, con
52 return CLAIM_AGENT_CLOUD_DISABLED;
53 }
54
55 -#if defined(ENABLE_CLOUD) && defined(ENABLE_ACLK)
55 +#ifndef DISABLE_CLOUD
56 int exit_code;
57 pid_t command_pid;
58 char command_exec_buffer[CLAIMING_COMMAND_LENGTH + 1];
src/daemon/buildinfo.c
+4 -9
@@ -69,7 +69,7 @@ typedef enum __attribute__((packed)) {
69 BIB_LIB_ZLIB,
70 BIB_LIB_BROTLI,
71 BIB_LIB_PROTOBUF,
72 - BIB_LIB_SSL,
72 + BIB_LIB_OPENSSL,
73 BIB_LIB_LIBDATACHANNEL,
74 BIB_LIB_JSONC,
75 BIB_LIB_LIBCAP,
@@ -650,17 +650,12 @@ static struct {
650 .json = "protobuf",
651 .value = NULL,
652 },
653 - [BIB_LIB_SSL] = {
653 + [BIB_LIB_OPENSSL] = {
654 .category = BIC_LIBS,
655 .type = BIT_BOOLEAN,
656 .analytics = NULL,
657 -#if defined(ENABLE_OPENSSL)
657 .print = "OpenSSL (cryptography)",
658 .json = "openssl",
660 -#elif defined(ENABLE_WOLFSSL)
661 - .print = "WolfSSL (cryptography)",
662 - .json = "wolfssl",
663 -#endif
659 .value = NULL,
660 },
661 [BIB_LIB_LIBDATACHANNEL] = {
@@ -1167,8 +1162,8 @@ __attribute__((constructor)) void initialize_build_info(void) {
1162 #ifdef HAVE_LIBDATACHANNEL
1163 build_info_set_status(BIB_LIB_LIBDATACHANNEL, true);
1164 #endif
1170 -#if defined(ENABLE_OPENSSL) || defined(ENABLE_WOLFSSL)
1171 - build_info_set_status(BIB_LIB_SSL, true);
1165 +#ifdef ENABLE_OPENSSL
1166 + build_info_set_status(BIB_LIB_OPENSSL, true);
1167 #endif
1168 #ifdef ENABLE_JSONC
1169 build_info_set_status(BIB_LIB_JSONC, true);
src/daemon/commands.c
-7
@@ -295,17 +295,10 @@ static cmd_status_t cmd_ping_execute(char *args, char **message)
295 static cmd_status_t cmd_aclk_state(char *args, char **message)
296 {
297 netdata_log_info("COMMAND: Reopening aclk/cloud state.");
298 -#ifdef ENABLE_ACLK
298 if (strstr(args, "json"))
299 *message = aclk_state_json();
300 else
301 *message = aclk_state();
303 -#else
304 - if (strstr(args, "json"))
305 - *message = strdupz("{\"aclk-available\":false}");
306 - else
307 - *message = strdupz("ACLK Available: No");;
308 -#endif
302
303 return CMD_STATUS_SUCCESS;
304 }
src/database/contexts/api_v2.c
-6
@@ -800,7 +800,6 @@ static void rrdhost_sender_to_json(BUFFER *wb, RRDHOST_STATUS *s, const char *ke
800 buffer_json_object_close(wb); // streaming
801 }
802
803 -#ifdef ENABLE_ACLK
803 static void agent_capabilities_to_json(BUFFER *wb, RRDHOST *host, const char *key) {
804 buffer_json_member_add_array(wb, key);
805
@@ -817,7 +816,6 @@ static void agent_capabilities_to_json(BUFFER *wb, RRDHOST *host, const char *ke
816 buffer_json_array_close(wb);
817 freez(capas);
818 }
820 -#endif
819
820 static inline void host_dyncfg_to_json_v2(BUFFER *wb, const char *key, RRDHOST_STATUS *s) {
821 buffer_json_member_add_object(wb, key);
@@ -895,9 +893,7 @@ static void rrdcontext_to_json_v2_rrdhost(BUFFER *wb, RRDHOST *host, struct rrdc
893 buffer_json_member_add_string(wb, "state", rrdhost_state_cloud_emulation(host) ? "reachable" : "stale");
894
895 rrdhost_health_to_json_v2(wb, "health", &s);
898 -#ifdef ENABLE_ACLK
896 agent_capabilities_to_json(wb, host, "capabilities");
900 -#endif
897 }
898
899 if (ctl->mode & (CONTEXTS_V2_NODE_INSTANCES)) {
@@ -941,9 +937,7 @@ static void rrdcontext_to_json_v2_rrdhost(BUFFER *wb, RRDHOST *host, struct rrdc
937 rrdhost_health_to_json_v2(wb, "health", &s);
938
939 host_functions2json(host, wb); // functions
944 -#ifdef ENABLE_ACLK
940 agent_capabilities_to_json(wb, host, "capabilities");
946 -#endif
941
942 host_dyncfg_to_json_v2(wb, "dyncfg", &s);
943 }
src/database/contexts/worker.c
-2
@@ -959,11 +959,9 @@ static void rrdcontext_dequeue_from_hub_queue(RRDCONTEXT *rc) {
959
960 static void rrdcontext_dispatch_queued_contexts_to_hub(RRDHOST *host, usec_t now_ut) {
961
962 -#ifdef ENABLE_ACLK
962 // check if we have received a streaming command for this host
963 if(!rrdhost_flag_check(host, RRDHOST_FLAG_ACLK_STREAM_CONTEXTS) || !aclk_connected || !host->rrdctx.hub_queue)
964 return;
966 -#endif
965
966 // check if there are queued items to send
967 if(!dictionary_entries(host->rrdctx.hub_queue))
src/database/engine/rrdengine.h
-6
@@ -6,14 +6,8 @@
6 #include <fcntl.h>
7 #include <lz4.h>
8 #include <Judy.h>
9 -#ifdef ENABLE_OPENSSL
9 #include <openssl/sha.h>
10 #include <openssl/evp.h>
12 -#elif defined(ENABLE_WOLFSSL)
13 -#include <wolfssl/options.h>
14 -#include <wolfssl/openssl/sha.h>
15 -#include <wolfssl/openssl/evp.h>
16 -#endif
11 #include "daemon/common.h"
12 #include "../rrd.h"
13 #include "rrddiskprotocol.h"
src/database/rrdfunctions-inflight.c
-4
@@ -438,7 +438,6 @@ int rrd_function_run(RRDHOST *host, BUFFER *result_wb, int timeout_s,
438
439 if(!http_access_user_has_enough_access_level_for_endpoint(user_access, rdcf->access)) {
440
441 -#ifdef ENABLE_ACLK
441 if(!aclk_connected)
442 code = rrd_call_function_error(result_wb,
443 "This Netdata must be connected to Netdata Cloud for Single-Sign-On (SSO) "
@@ -446,9 +445,6 @@ int rrd_function_run(RRDHOST *host, BUFFER *result_wb, int timeout_s,
445 HTTP_ACCESS_PERMISSION_DENIED_HTTP_CODE(user_access));
446
447 else if((rdcf->access & HTTP_ACCESS_SIGNED_ID) && !(user_access & HTTP_ACCESS_SIGNED_ID))
449 -#else
450 - if((rdcf->access & HTTP_ACCESS_SIGNED_ID) && !(user_access & HTTP_ACCESS_SIGNED_ID))
451 -#endif
448 code = rrd_call_function_error(result_wb,
449 "You need to be authenticated via Netdata Cloud Single-Sign-On (SSO) "
450 "to access this feature. Sign-in on this dashboard, "
src/database/rrdhost.c
-2
@@ -1384,9 +1384,7 @@ static void rrdhost_load_auto_labels(void) {
1384 if (localhost->system_info->prebuilt_dist)
1385 rrdlabels_add(labels, "_prebuilt_dist", localhost->system_info->prebuilt_dist, RRDLABEL_SRC_AUTO);
1386
1387 -#ifdef ENABLE_ACLK
1387 add_aclk_host_labels();
1389 -#endif
1388
1389 // The source should be CONF, but when it is set, these labels are exported by default ('send configured labels' in exporting.conf).
1390 // Their export seems to break exporting to Graphite, see https://github.com/netdata/netdata/issues/14084.
src/libnetdata/libnetdata.h
+1 -2
@@ -9,7 +9,7 @@ extern "C" {
9
10 #include "config.h"
11
12 -#if defined(ENABLE_OPENSSL) || defined(ENABLE_WOLFSSL)
12 +#ifdef ENABLE_OPENSSL
13 #define ENABLE_HTTPS 1
14 #endif
15
@@ -483,7 +483,6 @@ extern char *netdata_configured_host_prefix;
483 #include "popen/popen.h"
484 #include "simple_pattern/simple_pattern.h"
485 #ifdef ENABLE_HTTPS
486 -# include "ssl/ssl.h"
486 # include "socket/security.h"
487 #endif
488 #include "socket/socket.h"
src/libnetdata/socket/README.md
-8
@@ -6,11 +6,3 @@ learn_status: "Published"
6 learn_topic_type: "References"
7 learn_rel_path: "Developers/libnetdata"
8 -->
9 -
10 -# WolfSSL support
11 -
12 -Support for WolfSSL is currently in the experimental stage, as it does not yet offer all the features available in the
13 -OpenSSL library.
14 -
15 -When integrating with WolfSSL, it's essential to confirm that the version of WolfSSL being used has enabled support for
16 -the OpenSSL API during compilation. Failure to do so will result in compilation errors.
src/libnetdata/socket/security.c
+15 -38
@@ -18,11 +18,7 @@ static SOCKET_PEERS netdata_ssl_peers(NETDATA_SSL *ssl) {
18 if(unlikely(!ssl->conn))
19 sock_fd = -1;
20 else
21 -#if defined(ENABLE_OPENSSL)
21 sock_fd = SSL_get_rfd(ssl->conn);
23 -#elif defined(ENABLE_WOLFSSL)
24 - sock_fd = SSL_get_fd(ssl->conn);
25 -#endif
22
23 return socket_peers(sock_fd);
24 }
@@ -363,11 +359,7 @@ static inline bool want_read_write_should_retry(NETDATA_SSL *ssl, int err) {
359 int ssl_errno = SSL_get_error(ssl->conn, err);
360 if(ssl_errno == SSL_ERROR_WANT_READ || ssl_errno == SSL_ERROR_WANT_WRITE) {
361 struct pollfd pfds[1] = { [0] = {
366 -#if defined(ENABLE_OPENSSL)
362 .fd = SSL_get_rfd(ssl->conn),
368 -#elif defined(ENABLE_WOLFSSL)
369 - .fd = SSL_get_fd(ssl->conn),
370 -#endif
363 .events = (short)(((ssl_errno == SSL_ERROR_WANT_READ ) ? POLLIN : 0) |
364 ((ssl_errno == SSL_ERROR_WANT_WRITE) ? POLLOUT : 0)),
365 }};
@@ -445,13 +437,7 @@ bool netdata_ssl_accept(NETDATA_SSL *ssl) {
437 static void netdata_ssl_info_callback(const SSL *ssl, int where, int ret __maybe_unused) {
438 (void)ssl;
439 if (where & SSL_CB_ALERT) {
448 - netdata_log_debug(D_WEB_CLIENT,"SSL INFO CALLBACK %s %s",
449 -#if defined(ENABLE_OPENSSL)
450 - SSL_alert_type_string(ret),
451 -#else
452 - NULL,
453 -#endif
454 - SSL_alert_desc_string_long(ret));
440 + netdata_log_debug(D_WEB_CLIENT,"SSL INFO CALLBACK %s %s", SSL_alert_type_string(ret), SSL_alert_desc_string_long(ret));
441 }
442 }
443
@@ -462,7 +448,7 @@ static void netdata_ssl_info_callback(const SSL *ssl, int where, int ret __maybe
448 */
449 void netdata_ssl_initialize_openssl() {
450
465 -#if defined(ENABLE_OPENSSL) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
451 +#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
452 # if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097)
453 OPENSSL_config(NULL);
454 # endif
@@ -472,9 +458,11 @@ void netdata_ssl_initialize_openssl() {
458 SSL_library_init();
459
460 #else
461 +
462 if (OPENSSL_init_ssl(OPENSSL_INIT_LOAD_CONFIG, NULL) != 1) {
463 netdata_log_error("SSL library cannot be initialized.");
464 }
465 +
466 #endif
467 }
468
@@ -556,7 +544,7 @@ static SSL_CTX * netdata_ssl_create_server_ctx(unsigned long mode) {
544 static int netdata_id_context = 1;
545
546 //TO DO: Confirm the necessity to check return for other OPENSSL function
559 -#if defined(ENABLE_OPENSSL) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
547 +#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
548 ctx = SSL_CTX_new(SSLv23_server_method());
549 if (!ctx) {
550 netdata_log_error("Cannot create a new SSL context, netdata won't encrypt communication");
@@ -571,21 +559,14 @@ static SSL_CTX * netdata_ssl_create_server_ctx(unsigned long mode) {
559 return NULL;
560 }
561
574 - if (SSL_CTX_use_certificate_chain_file(ctx, netdata_ssl_security_cert) != 1) {
575 - goto end_ssl_server_ctx;
576 - }
562 + SSL_CTX_use_certificate_chain_file(ctx, netdata_ssl_security_cert);
563 #endif
564
579 -#if defined(ENABLE_OPENSSL) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
565 +#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
566 SSL_CTX_set_options(ctx, SSL_OP_NO_SSLv2|SSL_OP_NO_SSLv3|SSL_OP_NO_COMPRESSION);
567 #else
582 - if (SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION) != 1) {
583 - goto end_ssl_server_ctx;
584 - }
585 -
586 - if ( SSL_CTX_set_max_proto_version(ctx, netdata_ssl_select_tls_version(tls_version)) != 1) {
587 - goto end_ssl_server_ctx;
588 - }
568 + SSL_CTX_set_min_proto_version(ctx, TLS1_VERSION);
569 + SSL_CTX_set_max_proto_version(ctx, netdata_ssl_select_tls_version(tls_version));
570
571 if(tls_ciphers && strcmp(tls_ciphers, "none") != 0) {
572 if (!SSL_CTX_set_cipher_list(ctx, tls_ciphers)) {
@@ -597,13 +578,16 @@ static SSL_CTX * netdata_ssl_create_server_ctx(unsigned long mode) {
578 SSL_CTX_use_PrivateKey_file(ctx, netdata_ssl_security_key,SSL_FILETYPE_PEM);
579
580 if (!SSL_CTX_check_private_key(ctx)) {
600 - goto end_ssl_server_ctx;
581 + ERR_error_string_n(ERR_get_error(),lerror,sizeof(lerror));
582 + netdata_log_error("SSL cannot check the private key: %s",lerror);
583 + SSL_CTX_free(ctx);
584 + return NULL;
585 }
586
587 SSL_CTX_set_session_id_context(ctx,(void*)&netdata_id_context,(unsigned int)sizeof(netdata_id_context));
588 SSL_CTX_set_info_callback(ctx, netdata_ssl_info_callback);
589
606 -#if defined(ENABLE_OPENSSL) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_095)
590 +#if (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_095)
591 SSL_CTX_set_verify_depth(ctx,1);
592 #endif
593 netdata_log_debug(D_WEB_CLIENT,"SSL GLOBAL CONTEXT STARTED\n");
@@ -611,11 +595,6 @@ static SSL_CTX * netdata_ssl_create_server_ctx(unsigned long mode) {
595 SSL_CTX_set_mode(ctx, mode);
596
597 return ctx;
614 -end_ssl_server_ctx:
615 - ERR_error_string_n(ERR_get_error(), lerror, sizeof(lerror));
616 - netdata_log_error("SSL error: %s", lerror);
617 - SSL_CTX_free(ctx);
618 - return NULL;
598 }
599
600 /**
@@ -705,10 +684,8 @@ void netdata_ssl_cleanup()
684 netdata_ssl_exporting_ctx = NULL;
685 }
686
708 -#if defined(ENABLE_OPENSSL) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
687 +#if OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110
688 ERR_free_strings();
710 -#elif defined(ENABLE_WOLFSSL)
711 - wolfSSL_Cleanup();
689 #endif
690 }
691
src/libnetdata/socket/security.h
+18 -1
@@ -14,7 +14,24 @@ typedef enum __attribute__((packed)) {
14
15 # ifdef ENABLE_HTTPS
16
17 -#include "../ssl/ssl.h"
17 +#define OPENSSL_VERSION_095 0x00905100L
18 +#define OPENSSL_VERSION_097 0x0907000L
19 +#define OPENSSL_VERSION_110 0x10100000L
20 +#define OPENSSL_VERSION_111 0x10101000L
21 +#define OPENSSL_VERSION_300 0x30000000L
22 +
23 +# include <openssl/ssl.h>
24 +# include <openssl/err.h>
25 +# include <openssl/evp.h>
26 +# include <openssl/pem.h>
27 +# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
28 +# include <openssl/conf.h>
29 +# endif
30 +
31 +#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
32 +#include <openssl/core_names.h>
33 +#include <openssl/decoder.h>
34 +#endif
35
36 typedef struct netdata_ssl {
37 SSL *conn; // SSL connection
src/libnetdata/ssl/ssl.h deleted
-43
@@ -1,43 +0,0 @@
1 -#ifndef NETDATA_SSL_H
2 -#define NETDATA_SSL_H
3 -
4 -// External SSL libraries used with netdata
5 -
6 -#ifdef ENABLE_HTTPS
7 -
8 -#define OPENSSL_VERSION_095 0x00905100L
9 -#define OPENSSL_VERSION_097 0x0907000L
10 -#define OPENSSL_VERSION_110 0x10100000L
11 -#define OPENSSL_VERSION_111 0x10101000L
12 -#define OPENSSL_VERSION_300 0x30000000L
13 -
14 -#ifdef ENABLE_OPENSSL
15 -
16 -# include <openssl/ssl.h>
17 -# include <openssl/err.h>
18 -# include <openssl/sha.h>
19 -# include <openssl/evp.h>
20 -# include <openssl/pem.h>
21 -# if (SSLEAY_VERSION_NUMBER >= OPENSSL_VERSION_097) && (OPENSSL_VERSION_NUMBER < OPENSSL_VERSION_110)
22 -# include <openssl/conf.h>
23 -# endif
24 -
25 -#if OPENSSL_VERSION_NUMBER >= OPENSSL_VERSION_300
26 -#include <openssl/core_names.h>
27 -#include <openssl/decoder.h>
28 -#endif
29 -#elif defined(ENABLE_WOLFSSL)
30 -#include <wolfssl/options.h>
31 -#include <wolfssl/version.h>
32 -#include <wolfssl/ssl.h>
33 -#include <wolfssl/error-ssl.h>
34 -
35 -#include <wolfssl/openssl/ssl.h>
36 -#include <wolfssl/openssl/err.h>
37 -#include <wolfssl/openssl/sha.h>
38 -#include <wolfssl/openssl/evp.h>
39 -#endif // ENABLE_OPENSSL
40 -
41 -#endif // ENABLE_HTTPS
42 -
43 -#endif
src/streaming/receiver.c
+1 -3
@@ -445,9 +445,7 @@ static bool rrdhost_set_receiver(RRDHOST *host, struct receiver_state *rpt) {
445 rrdpush_receiver_replication_reset(host);
446
447 rrdhost_flag_clear(rpt->host, RRDHOST_FLAG_RRDPUSH_RECEIVER_DISCONNECTED);
448 -#ifdef ENABLE_ACLK
448 aclk_queue_node_info(rpt->host, true);
450 -#endif
449
450 rrdpush_reset_destinations_postpone_time(host);
451
@@ -782,7 +780,7 @@ static void rrdpush_receive(struct receiver_state *rpt)
780 }
781
782 netdata_log_debug(D_STREAM, "Initial response to %s: %s", rpt->client_ip, initial_response);
785 -#if defined(ENABLE_H2O) && defined(ENABLE_OPENSSL)
783 +#ifdef ENABLE_H2O
784 if (is_h2o_rrdpush(rpt)) {
785 h2o_stream_write(rpt->h2o_ctx, initial_response, strlen(initial_response));
786 } else {
src/streaming/sender.c
-4
@@ -634,7 +634,6 @@ static bool rrdpush_sender_connect_ssl(struct sender_state *s __maybe_unused) {
634 #endif
635 }
636
637 -#if defined(ENABLE_H2O) && defined(ENABLE_OPENSSL)
637 static int rrdpush_http_upgrade_prelude(RRDHOST *host, struct sender_state *s) {
638
639 char http[HTTP_HEADER_SIZE + 1];
@@ -732,7 +731,6 @@ err_cleanup:
731 http_parse_ctx_destroy(&ctx);
732 return 1;
733 }
735 -#endif
734
735 static bool rrdpush_sender_thread_connect_to_parent(RRDHOST *host, int default_port, int timeout, struct sender_state *s) {
736
@@ -871,7 +869,6 @@ static bool rrdpush_sender_thread_connect_to_parent(RRDHOST *host, int default_p
869 if(!rrdpush_sender_connect_ssl(s))
870 return false;
871
874 -#if defined(ENABLE_H2O) && defined(ENABLE_OPENSSL)
872 if (s->parent_using_h2o && rrdpush_http_upgrade_prelude(host, s)) {
873 ND_LOG_STACK lgs[] = {
874 ND_LOG_FIELD_TXT(NDF_RESPONSE_CODE, RRDPUSH_STATUS_CANT_UPGRADE_CONNECTION),
@@ -885,7 +882,6 @@ static bool rrdpush_sender_thread_connect_to_parent(RRDHOST *host, int default_p
882 host->destination->postpone_reconnection_until = now_realtime_sec() + 1 * 60;
883 return false;
884 }
888 -#endif
885
886 ssize_t len = (ssize_t)strlen(http);
887 ssize_t bytes = send_timeout(
src/web/api/web_api_v1.c
-4
@@ -1415,7 +1415,6 @@ inline int web_client_api_request_v1_info(RRDHOST *host, struct web_client *w, c
1415 return HTTP_RESP_OK;
1416 }
1417
1418 -#ifdef ENABLE_OPENSSL
1418 static int web_client_api_request_v1_aclk_state(RRDHOST *host, struct web_client *w, char *url) {
1419 UNUSED(url);
1420 UNUSED(host);
@@ -1432,7 +1431,6 @@ static int web_client_api_request_v1_aclk_state(RRDHOST *host, struct web_client
1431 buffer_no_cacheable(wb);
1432 return HTTP_RESP_OK;
1433 }
1435 -#endif
1434
1435 int web_client_api_request_v1_metric_correlations(RRDHOST *host, struct web_client *w, char *url) {
1436 return web_client_api_request_weights(host, w, url, default_metric_correlations_method, WEIGHTS_FORMAT_CHARTS, 1);
@@ -1892,7 +1890,6 @@ static struct web_api_command api_commands_v1[] = {
1890 .callback = web_client_api_request_v1_info,
1891 .allow_subpaths = 0
1892 },
1895 -#ifdef ENABLE_OPENSSL
1893 {
1894 .api = "aclk",
1895 .hash = 0,
@@ -1901,7 +1898,6 @@ static struct web_api_command api_commands_v1[] = {
1898 .callback = web_client_api_request_v1_aclk_state,
1899 .allow_subpaths = 0
1900 },
1904 -#endif
1901 {
1902 // deprecated - use /api/v2/info
1903 .api = "dbengine_stats",