Skip to content

Commit 881f180

Browse files
FliegendeWurstFliegendeWurst
authored
rustls-libssl: init at 0.2.1 (#363932)
2 parents 76b5d1a + 9b67b79 commit 881f180

File tree

3 files changed

+184
-0
lines changed

3 files changed

+184
-0
lines changed

‎nixos/tests/all-tests.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -910,6 +910,7 @@ in {
910910
rsyslogd = handleTest ./rsyslogd.nix {};
911911
rtkit = runTest ./rtkit.nix;
912912
rtorrent = handleTest ./rtorrent.nix {};
913+
rustls-libssl = handleTest ./rustls-libssl.nix {};
913914
rxe = handleTest ./rxe.nix {};
914915
sabnzbd = handleTest ./sabnzbd.nix {};
915916
samba = handleTest ./samba.nix {};

‎nixos/tests/rustls-libssl.nix‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
import ./make-test-python.nix (
2+
{ pkgs, lib, ... }:
3+
let
4+
caCert = builtins.readFile ./common/acme/server/ca.cert.pem;
5+
certPath = ./common/acme/server/acme.test.cert.pem;
6+
keyPath = ./common/acme/server/acme.test.key.pem;
7+
hosts = ''
8+
192.168.2.101 acme.test
9+
'';
10+
in
11+
{
12+
name = "rustls-libssl";
13+
meta.maintainers = with pkgs.lib.maintainers; [
14+
stephank
15+
cpu
16+
];
17+
18+
nodes = {
19+
server =
20+
{ lib, pkgs, ... }:
21+
{
22+
networking = {
23+
interfaces.eth1 = {
24+
ipv4.addresses = [
25+
{
26+
address = "192.168.2.101";
27+
prefixLength = 24;
28+
}
29+
];
30+
};
31+
extraHosts = hosts;
32+
firewall.allowedTCPPorts = [ 443 ];
33+
};
34+
35+
security.pki.certificates = [ caCert ];
36+
37+
services.nginx = {
38+
enable = true;
39+
package = pkgs.nginxMainline.override {
40+
openssl = pkgs.rustls-libssl;
41+
modules = [ ]; # slightly reduces the size of the build
42+
};
43+
44+
# Hardcoded sole input accepted by rustls-libssl.
45+
sslCiphers = "HIGH:!aNULL:!MD5";
46+
47+
virtualHosts."acme.test" = {
48+
onlySSL = true;
49+
sslCertificate = certPath;
50+
sslCertificateKey = keyPath;
51+
http2 = true;
52+
reuseport = true;
53+
root = lib.mkForce (
54+
pkgs.runCommandLocal "testdir" { } ''
55+
mkdir "$out"
56+
cat > "$out/index.html" <<EOF
57+
<html><body>Hello World!</body></html>
58+
EOF
59+
''
60+
);
61+
};
62+
};
63+
};
64+
65+
client =
66+
{ pkgs, ... }:
67+
{
68+
environment.systemPackages = [ pkgs.curlHTTP3 ];
69+
networking = {
70+
interfaces.eth1 = {
71+
ipv4.addresses = [
72+
{
73+
address = "192.168.2.201";
74+
prefixLength = 24;
75+
}
76+
];
77+
};
78+
extraHosts = hosts;
79+
};
80+
81+
security.pki.certificates = [ caCert ];
82+
};
83+
};
84+
85+
testScript = ''
86+
start_all()
87+
server.wait_for_open_port(443)
88+
client.succeed("curl --verbose --http1.1 https://acme.test | grep 'Hello World!'")
89+
client.succeed("curl --verbose --http2-prior-knowledge https://acme.test | grep 'Hello World!'")
90+
'';
91+
}
92+
)

‎pkgs/by-name/ru/rustls-libssl/package.nix‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
{
2+
lib,
3+
stdenv,
4+
llvmPackages,
5+
rustPlatform,
6+
fetchFromGitHub,
7+
pkg-config,
8+
openssl,
9+
nixosTests,
10+
}:
11+
12+
let
13+
version = "0.2.1";
14+
target = stdenv.hostPlatform.rust.rustcTargetSpec;
15+
libExt = stdenv.hostPlatform.extensions.sharedLibrary;
16+
in
17+
rustPlatform.buildRustPackage {
18+
pname = "rustls-libssl";
19+
inherit version;
20+
21+
src = fetchFromGitHub {
22+
owner = "rustls";
23+
repo = "rustls-openssl-compat";
24+
rev = "v/${version}";
25+
hash = "sha256-/QSFrkFVSRBmpXHc80dJFnYwvVYceAFnoCtmAGtnmqo=";
26+
};
27+
28+
# NOTE: No longer necessary in the next release.
29+
sourceRoot = "source/rustls-libssl";
30+
31+
cargoHash = "sha256-Yyrs2eN4QTGGD7A+VM1YkdsIRUh3laZac3rsJThjTXM=";
32+
33+
nativeBuildInputs = [
34+
pkg-config # for openssl-sys
35+
llvmPackages.lld # build.rs specifies LLD as linker
36+
];
37+
buildInputs = [
38+
openssl
39+
];
40+
41+
preCheck = ''
42+
# tests dlopen libcrypto.so.3
43+
export LD_LIBRARY_PATH=${lib.makeLibraryPath [ openssl ]}
44+
'';
45+
46+
# rustls-libssl normally wants to be swapped in for libssl, and reuses
47+
# libcrypto. Here, we accomplish something similar by symlinking most of
48+
# OpenSSL, replacing only libssl.
49+
outputs = [
50+
"out"
51+
"dev"
52+
];
53+
installPhase = ''
54+
mkdir -p $out/lib $dev/lib/pkgconfig
55+
56+
mv target/${target}/release/libssl${libExt} $out/lib/libssl${libExt}.3
57+
ln -s libssl${libExt}.3 $out/lib/libssl${libExt}
58+
59+
ln -s ${openssl.out}/lib/libcrypto${libExt}.3 $out/lib/
60+
ln -s libcrypto${libExt}.3 $out/lib/libcrypto${libExt}
61+
62+
if [[ -e ${openssl.out}/lib/engines-3 ]]; then
63+
ln -s ${openssl.out}/lib/engines-3 $out/lib/
64+
fi
65+
if [[ -e ${openssl.out}/lib/ossl-modules ]]; then
66+
ln -s ${openssl.out}/lib/ossl-modules $out/lib/
67+
fi
68+
69+
ln -s ${openssl.dev}/include $dev/
70+
71+
cp ${openssl.dev}/lib/pkgconfig/*.pc $dev/lib/pkgconfig/
72+
sed -i \
73+
-e "s|${openssl.out}|$out|g" \
74+
-e "s|${openssl.dev}|$dev|g" \
75+
$dev/lib/pkgconfig/*.pc
76+
'';
77+
78+
passthru.tests = nixosTests.rustls-libssl;
79+
80+
meta = {
81+
description = "Partial reimplementation of the OpenSSL 3 libssl ABI using rustls";
82+
homepage = "https://github.com/rustls/rustls-openssl-compat";
83+
changelog = "https://github.com/rustls/rustls-openssl-compat/releases";
84+
license = lib.licenses.asl20;
85+
platforms = lib.platforms.linux;
86+
maintainers = with lib.maintainers; [
87+
stephank
88+
cpu
89+
];
90+
};
91+
}

0 commit comments

Comments
 (0)