envoy源代码分析（七）-- ssl

 

如何使用openssl

官方有个库，专门干这个的。

https://github.com/envoyproxy/envoy-openssl

选好分支，有一些分支还没有合入代码呢，未必好使。我现在用的是v1.32

主要是看，根目录下，有没有 openssl 和 bssl-compat 这两个目录。

也可以关注他的merge request：https://github.com/jwendell

 

安装依赖

大致上，流程跟envoy一样，下面讲的是额外的。

envoy的参考文章：https://www.cnblogs.com/hugetong/p/18806059

额外依赖

sudo apt install libclang-18-dev

 

参考envoy-openssl的镜像脚本进行编译

https://github.com/envoyproxy/envoy-openssl/blob/release/v1.32/openssl/run_envoy_docker.sh

 

usermod -aG docker tong

newgrp docker

 

 

安装openssl

编译命令

https://github.com/openssl/openssl/releases/download/openssl-3.0.8/openssl-3.0.8.tar.gz

./config -d --prefix=/usr/local/openssl-3.0.8/ --openssldir=/usr/local/openssl-3.0.8/ enable-weak-ssl-ciphers
make
sudo make install_sw

echo "/usr/local/openssl-3.0.8/lib64/" | sudo tee /etc/ld.so.conf.d/openssl-3.0.8.conf
time bazel build envoy

 

开启weak编译算法

./config -d enable-weak-ssl-ciphers

 

查找支持的算法列表：

/usr/local/openssl-3.0.8/bin/openssl ciphers -v --provider default --provider legacy 'ALL'

 legacy：

/usr/local/openssl-3.0.13/bin/openssl ciphers -s -tls1_3 -v  --provider default --provider legacy 'ALL:@SECLEVEL=0'

tls1.3

/usr/local/openssl-3.0.13/bin/openssl ciphers -ciphersuites TLS_AES_128_CCM_8_SHA256 -v |grep TLS_AES_128_CCM_8

 

 

envoy中对boringssl的依赖

依赖定义在这个文件里：./bazel/repository_locations.bzl

 

可以看到 git version：2db0eb3f96a5756298dcd7f9319e56a98585bd10

 

编译boringssl

git checkout -b envoy-134 2db0eb3f96a5756298dcd7f9319e56a98585bd10

apt install cmake

cmake -B build

make -C build

 

编译 envoy-openssl库的其他问题

1  用cmake find openssl有问题，找到了系统默认，而不是我指定的，手工指定find openssl库

修改文件 https://github.com/envoyproxy/envoy-openssl/blob/release/v1.32/bssl-compat/cmake/openssl.cmake

为如下类似内容：

set(CMAKE_PREFIX_PATH /usr/local/openssl-3.0.8)
find_package(OpenSSL 3.0 COMPONENTS Crypto SSL)

message(STATUS "TONG OPENSSL_INCLUDE_DIR = ${OPENSSL_INCLUDE_DIR}")
message(STATUS "TONG OPENSSL_CRYPTO_LIBRARY = ${OPENSSL_CRYPTO_LIBRARY}")
message(STATUS "TONG OPENSSL_SSL_LIBRARY = ${OPENSSL_SSL_LIBRARY}")
message(STATUS "TONG OPENSSL_VERSION = ${OPENSSL_VERSION}")
message(STATUS "TONG OPENSSL_FOUND = ${OPENSSL_FOUND}")

if(OpenSSL_FOUND)
    add_custom_target(OpenSSL)
    get_filename_component(OPENSSL_LIBRARY_DIR ${OPENSSL_CRYPTO_LIBRARY} DIRECTORY)
    message(STATUS "Found OpenSSL ${OPENSSL_VERSION} (${OPENSSL_LIBRARY_DIR})")
else()
    message(FATAL_ERROR "SALB Openssl-3.0.16 is not installed.")
endif()

意思就是到指定目录下去找openssl。相当于强行指定版本。

 

2  报_Noreturn 相关的编译错误

/home/tong/.cache/bazel/_bazel_tong/a3d98a2b256c08bd774067ff5e782970/sandbox/processwrapper-sandbox/18/execroot/envoy/bssl-compat/source/EVP_DecodeBase64.c:2:
/home/tong/.cache/bazel/_bazel_tong/a3d98a2b256c08bd774067ff5e782970/sandbox/processwrapper-sandbox/18/execroot/envoy/bazel-out/k8-fastbuild/bin/bssl-compat/bssl-compat.build_tmpdir/include/ossl.h:6166:3: error: type name does not allow function specifier to be specified
 6166 |   ossl_ossl_noreturn ossl_OPENSSL_die_t ossl_OPENSSL_die;
      |   ^
/home/tong/.cache/bazel/_bazel_tong/a3d98a2b256c08bd774067ff5e782970/sandbox/processwrapper-sandbox/18/execroot/envoy/bazel-out/k8-fastbuild/bin/bssl-compat/bssl-compat.build_tmpdir/include/ossl/openssl/e_os2.h:288:30: note: expanded from macro 'ossl_ossl_noreturn'
  288 | #  define ossl_ossl_noreturn _Noreturn

无论是gcc还是clang都有，

对比了docker编译环境和我自己的编译环境，编译命令完全一致，那么只能是编译器版本问题。我报错的是llvm-18，官方能通过的是llvm-14

果然换成14就好了，看来是14检查更宽松。