PVA over TLS

.github/workflows/ci-scripts-build.yml

@@ -143,8 +143,10 @@ jobs:
     - name: "apt-get install"
       run: |
         sudo apt-get update
-        sudo apt-get -y install g++-mingw-w64-x86-64 cmake gdb qemu-system-x86
+        sudo apt-get -y install g++-mingw-w64-x86-64 cmake gdb qemu-system-x86 libssl-dev
       if: runner.os == 'Linux'
+    - name: Host Info
+      run: openssl version -a
     - name: Automatic core dumper analysis
       uses: mdavidsaver/ci-core-dumper@master
     - name: Prepare and compile dependencies

MANIFEST.in

@@ -4,6 +4,7 @@ include LICENSE
 include README.md
 
 include configure/CONFIG_PVXS_VERSION
+include configure/probe-openssl.c
 include src/*.h
 include src/*.h@
 include src/*.cpp

Makefile

@@ -5,8 +5,11 @@ include $(TOP)/configure/CONFIG
 # Directories to build, any order
 DIRS += configure
 
+DIRS += setup
+setup_DEPEND_DIRS = configure
+
 DIRS += src
-src_DEPEND_DIRS = configure
+src_DEPEND_DIRS = setup
 
 DIRS += tools
 tools_DEPEND_DIRS = src

bundle/Makefile

@@ -1,5 +1,7 @@
 TOP=..
 
+_PVXS_BOOTSTRAP = YES
+
 include $(TOP)/configure/CONFIG
 
 CMAKE ?= cmake
@@ -21,7 +23,6 @@ LIBEVENT_$(T_A) = $(INSTALL_LOCATION)/bundle/usr/$(T_A)
 CMAKEFLAGS += -DCMAKE_INSTALL_PREFIX:PATH="$(abspath $(LIBEVENT_$(T_A)))"
 
 # not needed, and may not be available on embedded targets, so never try
-CMAKEFLAGS += -DEVENT__DISABLE_OPENSSL=ON
 CMAKEFLAGS += -DEVENT__DISABLE_MBEDTLS=ON
 
 # not run, so why bother?

configure/CONFIG

@@ -25,5 +25,6 @@ include $(TOP)/configure/CONFIG_SITE
 ifdef T_A
  -include $(TOP)/configure/CONFIG_SITE.Common.$(T_A)
  -include $(TOP)/configure/CONFIG_SITE.$(EPICS_HOST_ARCH).$(T_A)
+ -include $(TOP)/configure/O.$(T_A)/TOOLCHAIN
 endif
 

configure/Makefile

@@ -1,22 +1,35 @@
 TOP=..
 
+# step 1.  Use -I... to test event-config.h
+#          produce configure/O.$(T_A)/TOOLCHAIN
+# step 2 in setup/Makefile
+_PVXS_BOOTSTRAP = YES
+
 include $(TOP)/configure/CONFIG
 
+# use custom libevent2 install prefix by:
+#   setting LIBEVENT only for single arch build
+#   setting LIBEVENT_$(T_A) for each arch
+#   leave unset to use implicit system search path
+# NOTE: only needed if not present in default search paths
+LIBEVENT ?= $(LIBEVENT_$(T_A))
+LIBEVENT_$(T_A) ?= $(wildcard $(abspath $(TOP)/bundle/usr/$(T_A)))
+
+INCLUDES += $(if $(LIBEVENT),-I$(LIBEVENT)/include)
+
 TARGETS = $(CONFIG_TARGETS)
 CONFIGS += $(subst ../,,$(wildcard $(CONFIG_INSTALLS)))
 
 CFG += CONFIG_PVXS_VERSION
-CFG += CONFIG_PVXS_MODULE
-CFG += RULES_PVXS_MODULE
 
 include $(TOP)/configure/RULES
 
 ifdef T_A
-install: $(TOP)/configure/CONFIG_SITE.Common.$(T_A)
-
-$(TOP)/configure/CONFIG_SITE.Common.$(T_A): toolchain.c
-	$(PREPROCESS.cpp)
+install: TOOLCHAIN
 
-CLEANS += ../CONFIG_SITE.Common.$(T_A)
+TOOLCHAIN: toolchain.c
+	$(CPP) $(CPPFLAGS) $(INCLUDES) ../toolchain.c > $@.tmp
+	$(CPP) $(CPPFLAGS) $(INCLUDES) ../probe-openssl.c > probe-openssl.out && echo "EVENT2_HAS_OPENSSL = YES" >> $@.tmp || echo "No OpenSSL"
+	$(MV) $@.tmp $@
 
 endif

configure/probe-openssl.c

@@ -0,0 +1,17 @@
+
+#include <openssl/opensslv.h>
+
+#ifndef OPENSSL_VERSION_NUMBER
+#  error Some antique OpenSSL version?
+#endif
+#if OPENSSL_VERSION_NUMBER < 0x30000000
+#  error Minimum OpenSSL 3.0
+#endif
+
+#include <event2/event-config.h>
+
+#ifndef EVENT__HAVE_OPENSSL
+#  error libevent not built with OpenSSL support
+#endif
+
+#include <event2/bufferevent_ssl.h>

configure/toolchain.c

@@ -7,6 +7,9 @@
  * MSVC preprocessor emits C comments in output
  */
 #endif
+#ifndef __has_include
+#  define __has_include(X) (0)
+#endif
 #define VERSION_INT(V,R,M,P) ( ((V)<<24) | ((R)<<16) | ((M)<<8) | (P))
 
 CONFIG_LOADED=YES

documentation/pkcs12.md

@@ -0,0 +1,102 @@
+# PKCS#12 files in brief
+
+The following is based on a reading of [RFC7292](https://datatracker.ietf.org/doc/html/rfc7292) as of July 2014.
+Also on observation of OpenSSL circa 3.1 and keytool circa Java 17.
+
+End users do not need to know this.
+
+## File Structure
+
+Each `PKCS#12` file contains a list of `AuthenticatedSafe` entries (aka. "Safes").
+
+```
+PKCS#12 file
+  AuthenticatedSafe (unencrypted)
+    ...
+  AuthenticatedSafe (password encrypted)
+    ...
+  AuthenticatedSafe (public key encrypted)
+```
+
+Each Safe may be: unencrypted, encrypted with a password, or encrypted with a public key.
+
+Each Safe contains a list of `SafeBag` entries (aka. "Bags").
+
+```
+PKCS#12 file
+  AuthenticatedSafe
+    *Bag
+      attributes...
+      value
+```
+
+Each Bag has an a list of "Attributes" and a "value".
+
+RFC7292 defines two attributes `friendlyName` and `localKeyId`.
+Additionally, Java defines another `oracle-jdk-trustedkeyusage` or `ORACLE_TrustedKeyUsage`.
+
+```
+PKCS#12 file
+  AuthenticatedSafe
+    keyBag              (unencrypted private key)
+    pkcs8ShroudedKeyBag (encrypted private key)
+    certBag             (certificate, usually X509)
+    crlBag              (certificate revocation list, usually X509CRL)
+    secretBag           (arbitrary encrypted bytes)
+    safeContentsBag
+      ... recursive list of Bags
+```
+
+RFC7292 defines 6 types of Bag, and leaves open the possibility of more.
+
+
+## Bag Attributes
+
+`friendlyName` is a string labeling a Bag.
+Java keytool uses these (via. `-alias`) to distinguish multiple private keys within one file.
+OpenSSL ignores them, and gets confused if multiple private keys are present.
+
+`localKeyId` is meant to identifies pairs of private key and certificate.
+
+`oracle-jdk-trustedkeyusage` has the same value as the X509 `extendedKeyUsage` extension.
+
+Released version of OpenSSL as of 3.1 circa Aug. 2023 [do not understand](https://github.com/openssl/openssl/issues/6684) `oracle-jdk-trustedkeyusage`.
+This is feature [planned for 3.2](https://github.com/openssl/openssl/pull/19025).
+
+TODO: keytool has been observed setting this to "6".  OpenSSL 3.2 set `anyExtendedKeyUsage`, aka. 1.
+
+## File Structure as Observed
+
+The structures of files created by `openssl pkcs12` and `keytool` are almost identical.
+
+For example, a file with a certificate/key pair, and an associated CA certificate is structured like:
+
+```
+PKCS#12
+  AuthenticatedSafe (unencrypted)
+    pkcs8ShroudedKeyBag
+      attributes
+        friendlyName = "my:cert:name"    (Java only)
+        localKeyId = ...                 (value will match the associated keyBag or pkcs8ShroudedKeyBag
+      value = private key...
+  AuthenticatedSafe (encrypted)
+    certBag
+      attributes
+        friendlyName = "my:cert:name"    (Java only)
+        localKeyId = ...                 (value will match the associated certBag
+      value = X509 certificate
+    certBag
+      attributes
+        friendlyName = "my:ca"           (Java only)
+        oracle-jdk-trustedkeyusage = ... (Java only)
+      value = X509 certificate
+```
+
+Notes...
+
+This structure leaves the friendlyName (aka `-alias`) and localKeyId associated with a private key unencrypted in all cases.
+
+Java keytool has been observed (after an `-importcert`) to put almost two certBag entries with the same certificate.
+One with the friendlyName from `-alias` and `oracle-jdk-trustedkeyusage` set,
+and a second with friendlyName set to the distinguishing name (eg. `CN=foo,O=bar`) and no `oracle-jdk-trustedkeyusage`.
+keytool seems to ignore any entries without `oracle-jdk-trustedkeyusage`, but OpenSSL reads them.

example/Makefile

@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -35,7 +34,7 @@ rpc_client_SRCS += rpc_client.cpp
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 

ioc/Makefile

@@ -11,8 +11,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to an issue in epics-base
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -80,7 +79,7 @@ LIB_LIBS += $(EPICS_BASE_IOC_LIBS)
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE
 

ioc/iochooks.cpp

@@ -202,6 +202,17 @@ void pvxrefdiff() {
     }
 }
 
+void pvxreconfigure()
+{
+    if (auto pPvxsServer = pvxsServer.load()) {
+        printf("Reconfiguring QSRV\n");
+        pPvxsServer->reconfigure(server::Config::from_env());
+        pvxsr(0); // print new configuration
+    } else {
+        fprintf(stderr, "Warning: QSRV not running\n");
+    }
+}
+
 } // namespace
 
 /**
@@ -302,6 +313,9 @@ void pvxsBaseRegistrar() {
                        "Save the current set of instance counters for reference by later pvxrefdiff.\n").implementation<&pvxrefsave>();
         IOCShCommand<>("pvxrefdiff",
                        "Show different of current instance counts with those when pvxrefsave was called.\n").implementation<&pvxrefdiff>();
+        IOCShCommand<>("pvxreconfigure",
+                       "Reconfigure QSRV using current values of EPICS_PVA*\n")
+                .implementation<&pvxreconfigure>();
 
         // Initialise the PVXS Server
         initialisePvxsServer();

qsrv/Makefile

@@ -3,8 +3,7 @@ TOP=..
 include $(TOP)/configure/CONFIG
 # cfg/ sometimes isn't correctly included due to a Base bug
 # so we do here (maybe again) as workaround
-include $(TOP)/configure/CONFIG_PVXS_MODULE
-include $(TOP)/configure/CONFIG_PVXS_VERSION
+-include $(wildcard $(TOP)/cfg/CONFIG*))
 #----------------------------------------
 #  ADD MACRO DEFINITIONS AFTER THIS LINE
 #=============================
@@ -31,7 +30,7 @@ FINAL_LOCATION ?= $(shell $(PERL) $(TOOLS)/fullPathName.pl $(INSTALL_LOCATION))
 #===========================
 
 include $(TOP)/configure/RULES
-include $(TOP)/configure/RULES_PVXS_MODULE
+-include $(wildcard $(TOP)/cfg/RULES*))
 #----------------------------------------
 #  ADD RULES AFTER THIS LINE