Skip to content

Backport TLS13-KDF to 1.24 release branch#1662

Merged
dagood merged 1 commit intomicrosoft:microsoft/release-branch.go1.24from
nicholasberlin:microsoft/release-branch.go1.24
May 6, 2025
Merged

Backport TLS13-KDF to 1.24 release branch#1662
dagood merged 1 commit intomicrosoft:microsoft/release-branch.go1.24from
nicholasberlin:microsoft/release-branch.go1.24

Conversation

@nicholasberlin
Copy link
Copy Markdown
Contributor

@nicholasberlin nicholasberlin commented May 5, 2025

Issue: #1658


  • Update the golang-fips/openssl vendor to golang-fips/openssl@6020143 (which is the result of this PR )
  • Adds a new build tag to gate the use of TLS13-KDF. This was accomplished by adding: internal/backend/tls13kdf_default.go and internal/backend/tls13kdf_ms_kdftls13.go in patches/0003-Implement-crypto-internal-backend.patch. The files are conditionally compiled via //go:build goexperiment.opensslcrypto && !goexperiment.ms_tls13kdf && linux && cgo //go:build !ms_tls13kdf and //go:build goexperiment.opensslcrypto && goexperiment.ms_tls13kdf && linux && cgo //go:build ms_tls13kdf, respectively. So, without adding the new build flag, ms_tls13kdf, TLS13-KDF will not be used.

@qmuntal
Copy link
Copy Markdown
Member

qmuntal commented May 5, 2025

I like the approach taken in this PR to filter TLS 1.3 KDF on the backend package. After reviewing this PR, I now think that using a goexperiment is an overkill, better use a good old build tag to gate the new KDF.

@nicholasberlin
Copy link
Copy Markdown
Contributor Author

Should I change the string goexperiment.ms_tls13kdf?
Get rid of goexperiment?

@dagood
Copy link
Copy Markdown
Member

dagood commented May 5, 2025

After reviewing this PR, I now think that using a goexperiment is an overkill, better use a good old build tag to gate the new KDF.

My two cents... there's an odd tradeoff here for a one-major-version-only build tag:

  • With a tag, you can upgrade from 1.24 to 1.25 without removing the tag and the build will still work. The tag won't do anything to the project at that point.
  • If someone sets GOEXPERIMENT=sytemcrypto,ms_tls13kdf and they aren't using the right version of Go, it'd show go: unknown GOEXPERIMENT ms_tls13kdf, and that can help catch infra problems.

Another option would be a godebug option. Quite different, and more flexible in a lot of ways. I don't think they're intended by upstream to exist in one major version and be removed in the next, but I think the upgrade behavior would resemble GOEXPERIMENT and not be overly strange. (But maybe there's actually good reason to do this as an on-by-default godebug in 1.25, if we anticipate any problems?)

That said, I don't think it's unreasonable to start with a tag. (Simplest.)

Should I change the string goexperiment.ms_tls13kdf?
Get rid of goexperiment?

Yeah, to avoid the freshly untrue implication that the GOEXPERIMENT system is involved.

+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+//go:build goexperiment.opensslcrypto && goexperiment.ms_tls13kdf && linux && cgo
Copy link
Copy Markdown
Member

@dagood dagood May 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I feel it would be better to make this independent. Tying ms_tls13kdf to the return value of SupportsTLS13KDF means "splitting" openssl_linux.go into more files, making the backend system more complicated to maintain. I don't think tls13kdf_default.go and tls13kdf_ms_kdftls13.go need to care about goexperiment.opensslcrypto, linux, or cgo. Adding another check to if boring.Enabled && boring.SupportsTLS13KDF() { seems like it would also convey the intent more clearly.

(It's not as if setting this tag actually affects whether this algorithm is supported, it only means that the algorithm should be used if it is supported.)

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok, reworked this. These files are now only controlled by //go:build ms_tls13kdf. And, they only set a new global boolean, TLS13KDFEnabled. crypto/tls/internal/tls13/tls13.go was updated to check the new boolean, before making a runtime support check.

This:

if boring.Enabled && boring.SupportsTLS13KDF() {

was changed to this:

if boring.Enabled && boring.TLS13KDFEnabled && boring.SupportsTLS13KDF() {

@nicholasberlin nicholasberlin force-pushed the microsoft/release-branch.go1.24 branch from b62413e to df6436e Compare May 5, 2025 18:17
+
+package backend
+
+const TLS13KDFEnabled = true
Copy link
Copy Markdown
Member

@dagood dagood May 5, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Apologies if you preferred the original @qmuntal. I just saw in your comment that you might have. 😄

My semi-outside perspective is that this is more "use the TLS13KDF backend function for TLS 1.3", and there could in theory be other uses for the backend function, so it doesn't necessarily make sense to include it in SupportsTLS13KDF and a more direct reference is reasonable. But maybe that's not a reasonable way to look at it given the OpenSSL API's name matching the scenario exactly.

A middle ground would be to change OpenSSL's SupportsTLS13KDF to return TLS13KDFEnabled && openssl.SupportsTLS13KDF(). This would preserve the independent files and their maintainability, but incorporate the tag's const into SupportsTLS13KDF rather than handling it in src/crypto/tls/internal/tls13/tls13.go.

I'd be fine with either one.

@dagood dagood merged commit 46d6bb6 into microsoft:microsoft/release-branch.go1.24 May 6, 2025
35 checks passed
@nicholasberlin
Copy link
Copy Markdown
Contributor Author

Thanks for the help!!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants