tls: Introduce OpenSSL

[michael-redpanda]

Introduces OpenSSL as an alternative TLS implementation to GnuTLS. This is a build-time configuration controlled by the CMake variable Seastar_USE_OPENSSL. The configure.py script has been updated to now have a --crypto-provider option. Valid arguments to that are OpenSSL and GnuTLS.

This implementation was released in Redpanda v24.2 on July 31st, and has been running on production clusters since.

Redpanda implemented these changes in order to provide a FIPS-compliant build to customers that require it (such as those wishing to undergo FedRAMP evaluation). OpenSSL was selected as it allows implementors to maintain the validation of the cryptographic module even when it's built from source.

• OpenSSL's security policy
  • See appendix A for instructions on how to build OpenSSL for FIPS
• FIPS 140-2 Implementation Guidance
  • See section G.5 Maintaining validation compliance of software or firmware cryptographic
    modules

No changes have been introduced to enable the FIPS provider for Seastar. It is up to the implementor to enable and use the FIPS cryptographic module if desired.

Notes for Redpanda developers:

This implementation is nearly identical to the one we are currently running with the following exceptions:

• The tls_session_logger is present only in this PR
• The changes introduced in tls: Add certificate_credentials to reload_callback redpanda-data/seastar#75 are not yet upstreamed so are not included here

[oleiman]

@michael-redpanda - made a subtask for this https://redpandadata.atlassian.net/browse/CORE-7791

Seems that the ossl backend is not raising a verification_error on the issuer/owner of other.crt, which is some dummy name that definitely doesn't appear in the trust store...not sure why that would be.

[oleiman]

Seems to be failing on https://github.com/redpanda-data/seastar/tree/v24.2.x as well

[oleiman]

This is from our fork v24.2.x branch:

 $ git bisect bad
6c0ac039bd60f79335ede465cc6a958479e065a6 is the first bad commit
commit 6c0ac039bd60f79335ede465cc6a958479e065a6
Author: Michael Boquard <[email protected]>
Date:   Thu May 30 15:39:52 2024 -0400

    build: Updated configure scripts

    - Updated configure helper scripts to be able to select OpenSSL
    vs GnuTLS.  Updated the SeastarDependencies file to select the
    correct minimum verison of OpenSSL.

    - Any code that exist in tls-impl.cc is meant to be shared across
    implementations, therefore any ones specific GnuTLS must have an
    additional condition to check that we are not building with OpenSSL

    Signed-off-by: Michael Boquard <[email protected]>
    Co-authored-by: Michael Boquard <[email protected]>
    Co-authored-by: Rob Blafford <[email protected]>

 CMakeLists.txt                  | 17 ++++++++++++++---
 cmake/SeastarDependencies.cmake |  3 +++
 configure.py                    |  7 +++++++
 seastar_cmake.py                |  2 ++
 src/CMakeLists.txt              |  7 +++++--
 src/net/tls-impl.cc             |  2 +-
 src/seastar.cc                  |  4 ++++
 7 files changed, 36 insertions(+), 6 deletions(-)

[oleiman]

oh, duh, that's just where we turned OpenSSL on I guess? prior to that would the openssl have been totally inert, or is there another way to run the tests w/ openssl backend or what?

[michael-redpanda]

Started upstream PR: scylladb#2569